Loading threat actor…
BlackByte, also tracked as Hecamede, Black_Byte, and BlackByte Ransomware Gang, is a financially motivated ransomware-as-a-service operation associated with Russia. It targets large organizations, including healthcare entities, and uses double extortion: encrypting systems and threatening to publish stolen data through a dedicated leak site. BlackByte intrusions exploit vulnerabilities in public-facing systems for initial access. Observed activity includes Cobalt Strike deployment, credential dumping, system and network discovery, process injection, PowerShell execution, and exfiltration through cloud-based file-sharing services. Operators inhibit system recovery and disable security products before deploying ransomware. A distinguishing capability is extensive use of bring-your-own-vulnerable-driver techniques to obtain privileged kernel access and disable endpoint defenses. BlackByte has exploited CVE-2019-16098 in the MSI Afterburner driver and abused vulnerable drivers from Dell, Zemana, GIGABYTE, and Intel. Its July 2024 encryptor deployed four vulnerable drivers to facilitate host encryption. Its security-evasion implementation has similarities to the open-source EDRSandblast tool and supports disabling more than 1,000 security-related drivers. Early BlackByte variants reused encryption keys, allowing potential recovery of some files encrypted before October 2021.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
134 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
17 malware families Mallory has associated with this actor across public reporting.
12 additional families tracked in Mallory.
11 CVEs Mallory has associated with this actor across public reporting. 11 of them are exploited in the wild (not necessarily by this actor).
5 more CVEs tied to this actor tracked in Mallory.
74 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.