H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Exbyte

[Exbyte](https://attack.mitre.org/software/S1179) is an exfiltration tool written in Go that is uniquely associated with [BlackByte](https://attack.mitre.org/groups/G1043) operations. Observed since 2022, [Exbyte](https://attack.mitre.org/software/S1179) transfers collected files to online file sharing and hosting services.(Citation: Symantec BlackByte 2022)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Exbyte](https://attack.mitre.org/software/S1179) is an exfiltration tool written in Go that is uniquely associated with [BlackByte](https://attack.mitre.org/groups/G1043) operations. Observed since 2022, [Exbyte](https://attack.mitre.org/software/S1179) transfers collected files to online file sharing and hosting services.(Citation: Symantec BlackByte 2022)

Labels

malware
10 recorded

Relationships

uses
from BlackByte
Group
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Execution Guardrails
Technique
uses
to Exfiltration Over Web Service
Technique
uses
to File and Directory Discovery
Technique
uses
to File Deletion
Technique
uses
to Local Groups
Technique
uses
to Native API
Technique
uses
to Security Software Discovery
Technique
uses
to System Checks
Technique
2 external

References

mitre-attack
S1179
open
Symantec BlackByte 2022
https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance