Overview
Ransomware. Uses dropper written in JavaScript to deploy a .NET payload.
- First tracked: 2021-10-04
- Discussed in our reports: Bahrain
Geography: origin and targets
Assessed origin: Russian Federation. Its payload stops on Russian and former-Soviet language settings, consistent with Russian-speaking operators. Attribution is uncertain: read it as an assessment, not proof.
United States of America14
Brazil4
United Kingdom3
Sweden2
Poland2
Mexico1
Spain1
India1
Japan1
Vietnam1
Exploited vulnerabilities
| Vendor | Product | CVE | Category | Source |
|---|---|---|---|---|
| VMware | ESXi | CVE-2024-37085 | Virtualization | microsoft.com, blog.talosintelligence.com |
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
Technique details
Initial Access (TA0001)
- T1078 · Valid Accounts: BlackByte has gained access to victim environments through legitimate VPN credentials.
- T1078.002 · Valid Accounts: Domain Accounts: BlackByte captured credentials for or impersonated domain administration users.
- T1190 · Exploit Public-Facing Application: BlackByte exploited vulnerabilities such as ProxyLogon and ProxyShell for initial access to victim environments.
Execution (TA0002)
- T1047 · Windows Management Instrumentation: BlackByte used WMI to delete Volume Shadow Copies on victim machines.
- T1053.005 · Scheduled Task/Job: Scheduled Task: BlackByte created scheduled tasks for payload execution.
- T1059.001 · Command and Scripting Interpreter: PowerShell: BlackByte used encoded PowerShell commands during operations. BlackByte has used remote PowerShell commands in victim networks.
- T1059.003 · Command and Scripting Interpreter: Windows Command Shell: BlackByte executed ransomware using the Windows command shell.
- T1569.002 · System Services: Service Execution: BlackByte created malicious services for ransomware execution.
Persistence (TA0003)
- T1053.005 · Scheduled Task/Job: Scheduled Task: BlackByte created scheduled tasks for payload execution.
- T1078 · Valid Accounts: BlackByte has gained access to victim environments through legitimate VPN credentials.
- T1078.002 · Valid Accounts: Domain Accounts: BlackByte captured credentials for or impersonated domain administration users.
- T1112 · Modify Registry: BlackByte performed Registry modifications to escalate privileges and disable security tools.
- T1136.002 · Create Account: Domain Account: BlackByte created privileged domain accounts during intrusions.
- T1505.003 · Server Software Component: Web Shell: BlackByte has used ASPX web shells following exploitation of vulnerabilities in services such as Microsoft Exchange.
- T1543.003 · Create or Modify System Process: Windows Service: BlackByte modified multiple services on victim machines to enable encryption operations. BlackByte has installed tools such as AnyDesk as a service on victim machines.
- T1547.001 · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder: BlackByte has used Registry Run keys for persistence.
Privilege Escalation (TA0004)
- T1053.005 · Scheduled Task/Job: Scheduled Task: BlackByte created scheduled tasks for payload execution.
- T1055 · Process Injection: BlackByte has injected Cobalt Strike into `wuauclt.exe` during intrusions. BlackByte has injected ransomware into `svchost.exe` before encryption.
- T1055.012 · Process Injection: Process Hollowing: BlackByte used process hollowing for defense evasion purposes.
- T1068 · Exploitation for Privilege Escalation: BlackByte has exploited CVE-2024-37085 in VMWare ESXi software for authentication bypass and subsequent privilege escalation.
- T1078 · Valid Accounts: BlackByte has gained access to victim environments through legitimate VPN credentials.
- T1078.002 · Valid Accounts: Domain Accounts: BlackByte captured credentials for or impersonated domain administration users.
- T1134.003 · Access Token Manipulation: Make and Impersonate Token: BlackByte constructed a valid authentication token following Microsoft Exchange exploitation to allow for follow-on privileged command execution.
- T1543.003 · Create or Modify System Process: Windows Service: BlackByte modified multiple services on victim machines to enable encryption operations. BlackByte has installed tools such as AnyDesk as a service on victim machines.
- T1547.001 · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder: BlackByte has used Registry Run keys for persistence.
Stealth (TA0005)
- T1036.008 · Masquerading: Masquerade File Type: BlackByte masqueraded configuration files containing encryption keys as PNG files.
- T1055 · Process Injection: BlackByte has injected Cobalt Strike into `wuauclt.exe` during intrusions. BlackByte has injected ransomware into `svchost.exe` before encryption.
- T1055.012 · Process Injection: Process Hollowing: BlackByte used process hollowing for defense evasion purposes.
- T1070.004 · Indicator Removal: File Deletion: BlackByte deleted ransomware executables post-encryption.
- T1078 · Valid Accounts: BlackByte has gained access to victim environments through legitimate VPN credentials.
- T1078.002 · Valid Accounts: Domain Accounts: BlackByte captured credentials for or impersonated domain administration users.
- T1134.003 · Access Token Manipulation: Make and Impersonate Token: BlackByte constructed a valid authentication token following Microsoft Exchange exploitation to allow for follow-on privileged command execution.
- T1140 · Deobfuscate/Decode Files or Information: BlackByte has encoded commands in base64-encoded sections concatenated together in PowerShell. BlackByte uses PowerShell commands to disable Windows Defender.
- T1480 · Execution Guardrails: BlackByte stopped execution if identified language settings on victim machines was Russian or one of several language associated with former Soviet republics. BlackByte has used ransomware variants requiring a key passed on the command line for the malware to execute.
Credential Access (TA0006)
- T1003 · OS Credential Dumping: BlackByte used tools such as Cobalt Strike and Mimikatz to dump credentials from victim systems.
Discovery (TA0007)
- T1012 · Query Registry: BlackByte queried registry values to determine system language settings.
- T1016 · System Network Configuration Discovery: BlackByte used tools such as Arp to pull system network information and identify connected devices.
- T1018 · Remote System Discovery: BlackByte used tools such as Arp to identify remotely-connected devices.
- T1046 · Network Service Discovery: BlackByte has used tools such as NetScan to enumerate network services in victim environments.
- T1082 · System Information Discovery: BlackByte used various system commands and tools to pull system information during operations.
- T1087.002 · Account Discovery: Domain Account: BlackByte has used tools such as AdFind to identify and enumerate domain accounts.
- T1135 · Network Share Discovery: BlackByte enumerated network shares on victim devices.
- T1482 · Domain Trust Discovery: BlackByte enumerated Active Directory information and trust relationships during operations.
- T1518.001 · Software Discovery: Security Software Discovery: BlackByte enumerated installed security products during operations.
- T1614.001 · System Location Discovery: System Language Discovery: BlackByte identified system language settings to determine follow-on execution.
Lateral Movement (TA0008)
- T1021.001 · Remote Services: Remote Desktop Protocol: BlackByte has used RDP to access other hosts within victim networks.
- T1021.002 · Remote Services: SMB/Windows Admin Shares: BlackByte used SMB file shares to distribute payloads throughout victim networks, including BlackByte ransomware variants during wormable operations.
- T1570 · Lateral Tool Transfer: BlackByte transfered tools such as Cobalt Strike and the AnyDesk remote access tool during operations using SMB shares.
Collection (TA0009)
- T1560 · Archive Collected Data: BlackByte compressed data collected from victim environments prior to exfiltration.
Exfiltration (TA0010)
- T1041 · Exfiltration Over C2 Channel: BlackByte transmitted collected victim host information via HTTP POST to command and control infrastructure.
- T1567 · Exfiltration Over Web Service: BlackByte has used services such as `anonymfiles.com` and `file.io` to exfiltrate victim data.
Command and Control (TA0011)
- T1071.001 · Application Layer Protocol: Web Protocols: BlackByte collected victim device information then transmitted this via HTTP POST to command and control infrastructure.
- T1105 · Ingress Tool Transfer: BlackByte has transferred tools such as Cobalt Strike to victim environments from file sharing and hosting websites.
- T1219 · Remote Access Tools: BlackByte has used tools such as AnyDesk in victim environments.
Impact (TA0040)
- T1486 · Data Encrypted for Impact: BlackByte has encrypted victim files for ransom. Early versions of BlackByte ransomware used a common key for encryption, but later versions use unique keys per victim.
- T1490 · Inhibit System Recovery: BlackByte resized and deleted volume shadow copy files to prevent system recovery after encryption.
- T1491.001 · Defacement: Internal Defacement: BlackByte left ransom notes in all directories where encryption takes place.
Resource Development (TA0042)
- T1583.003 · Acquire Infrastructure: Virtual Private Server: BlackByte staged encryption keys on virtual private servers operated by the adversary.
- T1608.001 · Stage Capabilities: Upload Malware: BlackByte has staged tools such as Cobalt Strike at public file sharing and hosting sites.
Defense Impairment (TA0112)
- T1112 · Modify Registry: BlackByte performed Registry modifications to escalate privileges and disable security tools.
- T1685 · Disable or Modify Tools: BlackByte disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.
- T1686 · Disable or Modify System Firewall: BlackByte modified firewall rules on victim machines to enable remote system discovery.
Tools
Defense evasion
- Dell Client driver (BYOVD)
- GIGABYTE Motherboard driver (BYOVD)
- MSI Afterburner driver (BYOVD)
- Zemana Anti-Rootkit driver
Discovery
- PowerView
- SoftPerfect NetScan
Offensive tooling
- Cobalt Strike
- PowerShell Empire
Remote management tools
- AnyDesk
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| — | DLS | 6iaj3efye3q62xjgfxyegrufhewxew7yt4scxjd45tlfafyja6q4ctqd[.]onion | No |
| BB Auction | DLS | jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad[.]onion | No |
| BB Auction | DLS | dounczge5jhw4iztnnpzp54kd4ot3tikhjsimurtcewqssgye6vvrhqd[.]onion | No |
| BlackByte BLOG | DLS | f5uzduboq4fa2xkjloprmctk7ve3dm46ff7aniis66cbekakvksxgeqd[.]onion | No |
| File downloader | Files | tj3ty2q5jm5au3bmd2embtjscd3qjt7nfio2o7cr6moyy5kgil5pieqd[.]onion | No |
| BB Auction | DLS | 53d5skw4ypzku4bfq2tk2mr3xh5yqrzss25sooiubmjz67lb3gdivcad[.]onion | No |
| BlackByte BLOG | DLS | ce6roic2ykdjunyzazsxmjpz5wsar4pflpoqzntyww5c2eskcp7dq4yd[.]onion | No |
| BlackByte BLOG | DLS | dlyo7r3n4qy5fzv4645nddjwarj7wjdd6wzckomcyc7akskkxp4glcad[.]onion | No |
| BlackByte BLOG | DLS | fl3xpz5bmgzxy4fmebhgsbycgnz24uosp3u4g33oiln627qq3gyw37ad[.]onion | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11