Loading malware…
BlackByte Ransomware is a Windows ransomware family associated with the BlackByte threat group. It is distributed through a JavaScript launcher and supports deployment across compromised networks. It discovers connected network shares, queries Active Directory for remote hostnames, transfers ransomware payloads through mapped SMB shares, and creates scheduled tasks to execute those payloads remotely. It also enables the legacy SMBv1 protocol during execution.
Before full execution, BlackByte identifies installed security products, checks the system language, and enumerates Windows Registry settings associated with application execution options. It uses a hard-coded mutex to prevent simultaneous instances and terminates when the mutex already exists or the system language matches an exclusion list. To impair defenses, it adds JavaScript and executable file extensions to Microsoft Defender exclusions and terminates and removes the Raccine anti-ransomware utility. It also modifies the Windows Registry to prevent system recovery.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
BlackByte Ransomware looks for security software products prior to full execution.
48 distinct techniques documented for this family, organized by ATT&CK tactic.
The attack usually starts with a network entry point, either a previously compromised host or a software vulnerability which is exploitable from the network.
The BlackByte gang often uses phishing and/or vulnerable unpatched applications or services like vulnerable versions of SonicWall VPN or the ProxyShell vulnerability in Microsoft Exchange servers to gain access to the victim's network.
The BlackByte gang often uses phishing and/or vulnerable unpatched applications or services like vulnerable versions of SonicWall VPN or the ProxyShell vulnerability in Microsoft Exchange servers to gain access to the victim's network.
Scheduled tasks may be created and artifacts have been observed at Windows\System32\Tasks
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Observed Commands: cmd.exe /c powershell -command "$x = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String(...
Observed Commands: cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
Examples include 'BlackByte Ransomware is distributed as an obfuscated JavaScript launcher file' and 'Water Curupira Pikabot Distribution used highly obfuscated JavaScript files as one initial installer for Pikabot.'
Scheduled tasks may be created and artifacts have been observed at Windows\System32\Tasks
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
The attack usually starts with a network entry point, either a previously compromised host or a software vulnerability which is exploitable from the network.
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
It seems to be that executing the actual ransomware is the last step once they are done with lateral movement and make themselves persistent in the network by adding additional admin accounts.
Annotations ID Technique Tactic T1543 Create or Modify System Process Persistence
XMRIG Driver Loaded ... T1543.003 ... Windows Suspicious Driver Loaded Path
Scheduled tasks may be created and artifacts have been observed at Windows\System32\Tasks
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Process injection has been observed on processes it creates.
The attack usually starts with a network entry point, either a previously compromised host or a software vulnerability which is exploitable from the network.
Annotations ID Technique Tactic T1543 Create or Modify System Process Persistence
XMRIG Driver Loaded ... T1543.003 ... Windows Suspicious Driver Loaded Path
The base64 encoded string in the following command... Decodes to: Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}
Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'
Executables Or Script Creation In Temp Path ... T1036
Process injection has been observed on processes it creates.
It then tries to disable Florian Roth's Raccine ransomware protection tool and a few other commands mentioned in the FBI document.
The attack usually starts with a network entry point, either a previously compromised host or a software vulnerability which is exploitable from the network.
The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'
BlackByte seems to have a preference for this tool and often uses typical living-off-the-land binaries (LoLBins), besides other publicly available commercial and non-commercial software like 'netscanold' or 'psexec'.
"BlackByte Ransomware uses the SetThreadExecutionState API to prevent the victim system from entering sleep"
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
Stop-Service -Name $x;Set-Service -StartupType Disabled $x
The following analytic detects the modification of firewall settings to allow file and printer sharing. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving 'netsh' commands that enable file and printer sharing.
Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls.
"...can enumerate registry keys... backdoor can query the Windows Registry to gather system information... executed the reg query command... used RegQueryValueExA..."
net.exe view arp.exe -a
%AppData%\dummy This file is a text file containing a list of machine names that can be reached on the network.
The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
powershell.exe Import-Module ActiveDirectory;Get-ADComputer -Filter * -Properties * | FT Name
"BlackByte Ransomware uses the SetThreadExecutionState API to prevent the victim system from entering sleep"
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.
Multiple malware families (e.g., Avaddon, Bazar, Clop, Ryuk, REvil, LockBit, Zeus Panda) check OS language/keyboard layout/locale and terminate or alter execution if the system matches excluded languages (commonly Russian/CIS) or does not match desired target languages (e.g., Spanish/Portuguese, Arabic, Persian).
In most incidents, they like to use the AnyDesk remote management software to control victim machines.
Previous versions of BlackByte ransomware downloaded a .png file from IP addresses 185.93.6.31 and 45.9.148.114 prior to encryption.
These "affiliates" also steal files from the hacked networks, which the BlackByte gang uses as leverage in negotiations, threatening victims that they will release the stolen files on a dark web "leak site" if they don't pay their extortion demands.
Additionally, BlackByte is considered part of the big game ransomware groups, which are targeting large, high-profile targets, looking to exfiltrate internal data and threatening to publicly release it.
BlackByte is a Ransomware as a Service (RaaS) group that encrypts files on compromised Windows host systems, including physical and virtual servers.
The following analytic detects multiple attempts to stop or delete services on a system using net.exe, sc.exe, or net1.exe . It leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line executions within a one-minute window.
Decodes to: Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}
The following analytic detects suspicious raw access reads to the drive containing the Master Boot Record (MBR)... adversaries often target the MBR to wipe, encrypt, or overwrite it as part of their impact payload.
BlackByte Ransomware modifies the victim Registry to prevent system recovery; ShrinkLocker modifies various registry keys associated with system logon and BitLocker functionality to effectively lock-out users following disk encryption.
the operators of the BlackByte ransomware listed the team as one of their victims on Saturday on a dark web "leak site" the group typically uses to shame victims and force them into paying their extortion demands
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.