Loading malware…
BlackByte is a ransomware family and ransomware-as-a-service operation active since approximately July 2021. Operated by the group tracked as Hecamede, it targets corporate Windows environments worldwide, including workstations and physical and virtual servers. Victims have included organizations in the government facilities, financial services, and food and agriculture sectors. BlackByte attacks employ double extortion, combining file encryption with data theft and threats to publish stolen information.
BlackByte intrusions have exploited vulnerabilities in public-facing systems, particularly Microsoft Exchange Server through the ProxyShell and ProxyLogon exploit chains. Attackers have used Cobalt Strike, AnyDesk, AdFind, NetScan, and PowerView during intrusion activity. Observed behaviors include credential dumping, network and Active Directory discovery, privilege escalation, and lateral movement. The ransomware can propagate by copying itself to remote systems and executing through scheduled tasks. At least one affiliate has used Exbyte, a separate Go-based exfiltration tool that uploads victim documents to cloud storage.
The ransomware disables security controls, terminates security, backup, database, and application processes, and deletes Volume Shadow Copies to impede recovery. BlackByte uses process injection, including process hollowing, and performs checks for debuggers, sandbox artifacts, and security software. Its bring-your-own-vulnerable-driver attack chain abuses signed Windows drivers to impair endpoint protection from kernel space. Documented exploitation includes CVE-2019-16098 in the MSI Afterburner driver; a July 2024 encryptor deployed vulnerable drivers from MSI, Dell, Zemana, and GIGABYTE. Variants also bypass User Account Control and remove their on-disk executable after execution.
Early implementations were written in C#, followed by Go-based variants beginning around September 2021. The February 2022 generation replaced earlier RSA/AES encryption with Curve25519 and ChaCha20-based encryption. BlackByte encrypts local and network-accessible data, targets backup-related storage, leaves ransom instructions, and can repeatedly print ransom messages on connected printers. It avoids encryption on systems configured with several languages associated with Commonwealth of Independent States countries. Encryption-key reuse in early versions enabled recovery of some files encrypted before October 2021, but that weakness does not establish recoverability for later variants.
15 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 more CVEs associated with this family tracked in Mallory.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Symantec’s Threat Hunter Team has discovered that at least one affiliate of the BlackByte ransomware (Ransom.Blackbyte) operation has begun using a custom data exfiltration tool during their attacks.
43 distinct techniques documented for this family, organized by ATT&CK tactic.
Further analysis revealed that Fox Tempest expanded its offerings earlier this year by providing customers with pre-configured virtual machines hosted through Cloudzy infrastructure. Users could upload malware to these systems and receive digitally signed binaries generated through certificates controlled by the group.
... vulnérabilité « CVE-2024-37085 » de contournement d'authentification ... pour déployer des ransomwares et obtenir un accès administratif complet aux réseaux des victimes.
Initial access in Blackbyte intrusions is typical achieved through the exploitation of vulnerabilities in public-facing devices.
BlackByte uses the Windows task scheduler to execute the ransomware on the remote host... schtasks.exe /Create /S /TN /TR "C:\Users\Public\ -s " /ru SYSTEM /sc onlogon /RL HIGHEST /f
T1059.001 PowerShell
This allows BlackByte v2 to execute the svchost.exe process that it injects into with elevated privileges.
They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
BlackByte uses the Windows task scheduler to execute the ransomware on the remote host... schtasks.exe /Create /S /TN /TR "C:\Users\Public\ -s " /ru SYSTEM /sc onlogon /RL HIGHEST /f
... vulnérabilité « CVE-2024-37085 » de contournement d'authentification ... pour déployer des ransomwares et obtenir un accès administratif complet aux réseaux des victimes.
T1112 Modify Registry
The adversary remotely created a draft email with an attachment saved in the user’s Drafts folder... exported the entire mailbox to a PST file format, with an ASPX extension... writing an ASPX file to the folder ...\owa\auth\current\themes (T1505.003 Server Software Component: Web Shell).
It then creates a service with the following details: binPath = C:\systemdata\generalate
BlackByte uses the Windows task scheduler to execute the ransomware on the remote host... schtasks.exe /Create /S /TN /TR "C:\Users\Public\ -s " /ru SYSTEM /sc onlogon /RL HIGHEST /f
T1055 Process Injection
BYOVD (Bring Your Own Vulnerable Driver) is a class of attack in which threat actors drop known vulnerable drivers on a compromised machine and then exploit the bug(s) to gain kernel-level privileges.
... vulnérabilité « CVE-2024-37085 » de contournement d'authentification ... pour déployer des ransomwares et obtenir un accès administratif complet aux réseaux des victimes.
It then creates a service with the following details: binPath = C:\systemdata\generalate
BlackByte Ransomware Registry Changes - CMD ... 1. Elevate Local Privilege by disabling UAC Remote Restrictions
In BlackByte v2, an additional privilege escalation method was added that exploits the CMSTPLUACOM interface to bypass UAC.
Both Go-based BlackByte variants encrypt most strings using a tool similar to AdvObfuscator... Each string is decrypted using a unique algorithm with polymorphic code
BlackByte samples are typically packed with UPX... the most recent BlackByte samples... are packed with a modified version of UPX. The names of the sections have been renamed from UPX0 and UPX1 to BB0 and BB1
During the 2016 Ukraine Electric Power Attack, Sandworm Team masqueraded executables as .txt files.
Kapeka masquerades as a Microsoft Word Add-In file, with the extension .wll, but is a malicious DLL file.
T1055 Process Injection
BlackByte then deletes its original binary on disk by executing the command: C:\Windows\system32\cmd.exe /c ping 1.1.1.1 -n 10 > Nul & Del /F /Q
BlackByte removes traces after execution and changes timestamps, complicating an investigation that starts after files have already been locked.
... vulnérabilité « CVE-2024-37085 » de contournement d'authentification ... pour déployer des ransomwares et obtenir un accès administratif complet aux réseaux des victimes.
The malware checks the following DLL modules in memory shown in Table 5 and exits if they are present
They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
T1112 Modify Registry
Microsoft has announced the disruption of a large-scale malware-signing-as-a-service (MSaaS) operation that exploited its Azure Artifact Signing platform to generate fraudulent code-signing certificates... The group allegedly abused Microsoft's Artifact Signing service to create short-lived digital certificates that allowed malware to appear legitimate to both users and operating systems.
T1562.001 Disable or Modify Tools
T1562.004 Disable or Modify System Firewall
T1003 OS Credential Dumping
T1016 System Network Configuration Discovery
T1018 Remote System Discovery
The following commands are then executed to discover other computers and network file shares: net view arp -a
BlackByte ransomware terminates the following processes shown in Table 2 at the beginning of the execution... Many of these process names are related to business applications... In addition, the list contains a large number of malware analyst tools
In order to identify virtual machines on the victim's system, BlackByte will execute the command: powershell Get-VM
The malware executes mountvol.exe to try to mount additional volumes... This is likely an attempt to mount and encrypt backup volumes
The malware checks the following DLL modules in memory shown in Table 5 and exits if they are present
BlackByte ransomware resolves the victim's system language... If the system language matches any from this list, BlackByte will exit without performing file encryption.
BlackByte also attempts to access administrative shares A$ through Z$ and the folders shown in Table 4.
If the -a flag is passed via the command-line, BlackByte attempts to copy itself to remote computer's public folders via the administrative share \\ \c$\Users\Public\ .
T1560.001 Archive via Utility
the attackers use Certutil to download and execute the components that it needs to propagate in the network.
“SolarWinds Compromise… APT29 used HTTP for C2 and data exfiltration.” “BeaverTail… HTTP POST to exfiltrate data to C2 infrastructure.” “StealBit can use HTTP to exfiltrate files…” “ThiefQuest uploads files via unencrypted HTTP.”
As of December 8th, 2021, Blackbyte uses the anonymous file upload sites of ‘anonymfiles[.]com’ and ‘file[.]io’ ... It is recommended to block these sites on your firewall/proxy technologies in order to reduce the likelihood of data exfiltration.
Early intrusions of Blackbyte re-used encryption keys, meaning that files encrypted prior to October 2021 may be recoverable.
The following commands are executed by BlackByte to stop services that may hinder file encryption... BlackByte also terminates the following services that are associated with antivirus products, backup software, and business applications
T1490 Inhibit System Recovery
DDoS-компонент - T1498 (Network Denial of Service) или T1499 (Endpoint Denial of Service), оба под тактикой Impact. Но Impact здесь не цель, а средство.
The threat group exfiltrates data prior to deploying ransomware and leaks the stolen information if a ransom is not paid... The threat group also performs double extortion attacks by stealing an organization's files and leaking them online if the ransom is not paid.
72 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
144 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.