Loading story…
BlackByte emerged as a ransomware-as-a-service operation targeting Windows environments across critical infrastructure and other sectors, with victims reported in government facilities, finance, food and agriculture, and broad industry verticals worldwide. U.S. authorities said some intrusions began with exploitation of a Microsoft Exchange vulnerability, while other reporting tied initial access to phishing and ProxyShell activity. Once inside, BlackByte operators and affiliates used lateral movement, privilege escalation, scheduled tasks, remote execution, and data theft before encrypting systems and threatening publication on leak sites, with activity concentrated heavily in North America and Europe and notable interest in Latin American targets.
Technical analyses show the group rapidly improved its malware after early versions exposed a major weakness: some samples fetched a disguised forest.png key file from hardcoded infrastructure and reused the same symmetric key across victims, enabling decryption in certain cases. Later BlackByte variants shifted from C# to Go, strengthened cryptography from earlier AES/RSA-based approaches to Curve25519 and ChaCha20, and expanded capabilities including process and service termination, shadow-copy deletion, Defender exclusion changes, AMSI evasion, worm-like propagation through Active Directory and SMB, process injection, and so-called print bombing. Researchers and government agencies also documented use of tools such as AnyDesk, WinRAR, certutil, vssadmin, and network scanners, underscoring BlackByte’s progression into a more resilient and operationally mature extortion platform.
TTPs, infrastructure, and targeting history in one profile.
12 events from the most recent confirmed update back to the earliest known activity.
On October 21, 2022, Symantec reported that at least one BlackByte affiliate was deploying a custom Go-based exfiltration tool named Exbyte to steal victim documents and upload them to Mega.co.nz. The report also detailed recent BlackByte 2.0 intrusion tradecraft, including Exchange ProxyShell and ProxyLogon exploitation, anti-analysis checks, and EDR-evasion behavior.
On May 18, 2022, Cisco Talos reported that BlackByte had been active globally, with attacks observed since March and victims across North America, Colombia, the Netherlands, China, Mexico, and Vietnam. The report detailed initial access via phishing, SonicWall VPNs, and Exchange ProxyShell, along with use of AnyDesk, PsExec, netscanold, defense-disabling behavior, and delayed ransomware deployment ending with the BlackByteRestore.txt note.
Reports in May 2022 indicated BlackByte was among ransomware operations targeting Latin American governments, and operators reportedly claimed a compromise of a Peruvian government entity.
In May 2022, Trend Micro observed a sharp increase in BlackByte detections affecting the government sector compared with earlier telemetry trends.
Trend Micro telemetry showed a drastic increase in BlackByte detections in May 2022 after relatively consistent activity from October 2021 through March 2022.
On February 11, 2022, the FBI and U.S. Secret Service released a joint advisory describing BlackByte tradecraft, victim sectors, indicators of compromise, and mitigation guidance.
A more feature-rich Go-based BlackByte v2 appeared around February 2022, introducing updated encryption including Curve25519 and ChaCha20.
As of November 2021, BlackByte had compromised multiple U.S. and foreign businesses, including victims in the government facilities, financial, and food and agriculture sectors.
On October 15, 2021, Trustwave SpiderLabs published an in-depth analysis of BlackByte and released a GitHub decryptor based on a key-reuse flaw involving the downloaded "forest.png" file.
BlackByte was redeveloped from an earlier C# implementation into a Go-based variant observed around September 2021, marking a notable evolution in the malware family.
BlackByte first emerged around July 2021 as a ransomware operation, later described as operating under a ransomware-as-a-service model.
On October 19, 2021, SpiderLabs updated its BlackByte decryptor repository to add a compiled executable and a sample encrypted file for testing.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 45 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
trendmicro.com
Open sourcezscaler.com
Open sourceadvintel.io
Open sourcesymantec-enterprise-blogs.security.com
Open sourceblog.talosintelligence.com
Open sourcebleepingcomputer.com
Open sourcetrustwave.com
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BlackCat/ALPHV operators were linked to intrusions that began with exploitation of vulnerable **Microsoft Exchange** servers, including **`CVE-2021-31207`** in ProxyShell-style activity and other unpatched Exchange exposures. Investigators observed the attackers planting **ASPX web shells**, using IIS worker processes to launch PowerShell, and establishing persistence and remote access with tools including **MobaXterm**. In one case, a tampered **`libeay32.dll`** was downloaded to sideload **Cobalt Strike**, while post-compromise activity included credential theft through **Mimikatz** or **LSASS** dumping with Process Hacker, along with account and network discovery using **SoftPerfect Network Scanner**, **NetScan**, **BloodHound**, **Inveigh**, and **CrackMapExec**. Before encryption, the operators compressed targeted data with **WinRAR** or **7-Zip** and exfiltrated files through **rclone**, **MEGAsync**, and in some cases **FileZilla** or **WinSCP**. Lateral movement and staging were carried out over SMB, including use of **SysVol** shares and local paths such as **`C:\Windows\debug`**, followed by permission changes, shadow copy deletion, recovery disabling, and log clearing. Researchers also identified a newer BlackCat variant with previously undocumented command-line options including **`--safeboot`** and **`--sleep-restart`**, underscoring the group’s continued ability to target **Windows, Linux, and VMware ESXi** environments while pairing encryption with data theft and Tor-based extortion.
Aug 15, 2026
Black Basta emerged as a fast-growing ransomware-as-a-service operation that hit organizations across the United States, Canada, the United Kingdom, Australia, and New Zealand, with victims reported in manufacturing, construction, transportation, telecommunications, and pharmaceuticals. The group has been tied to human-operated intrusions that begin with spearphishing emails and password-protected ZIP archives, often delivering **QakBot** through ISO or JavaScript-based loaders that can bypass Windows Mark-of-the-Web protections, including abuse linked to `CVE-2022-44698`. After initial access, the attackers use **SystemBC**, **Cobalt Strike**, and **Mimikatz** for command and control, credential theft, persistence, and lateral movement, including SMB service execution and **PsExec**. Black Basta operators commonly try to disable Windows Defender and EDR tools, exfiltrate data with **Rclone**, delete volume shadow copies, encrypt files with the `.basta` extension, and leave a `readme.txt` ransom note while threatening to publish stolen data on a TOR leak site if payment is not made.
Aug 15, 2026
BlackCat/ALPHV affiliates carried out targeted double-extortion attacks by stealing data and deploying ransomware across Windows, Linux, and VMware ESXi environments, using a Rust-based payload that supports extensive customization. Reporting from Microsoft, Netskope, and Forescout shows the group gaining initial access through several routes, including compromised RDP credentials, exploitation of an unpatched Exchange server, an Internet-exposed SonicWall firewall, and a contractor account compromised via a malicious browser extension that led to virtual desktop access without MFA. After entry, operators escalated privileges, enumerated domains and devices, dumped credentials, and moved laterally with legitimate tools such as **PsExec** before staging broad encryption operations. In one analyzed intrusion, attackers used a compromised domain account to push the **ExMatter** exfiltration tool and the BlackCat payload to more than 2,000 machines, with ExMatter collecting selected file types and sending them over WebDAV to attacker-controlled infrastructure. Researchers also documented BlackCat features including self-propagation via NetBIOS discovery, shadow copy deletion, service termination, event log clearing attempts, and ESXi-specific actions such as stopping virtual machines and deleting snapshots. Separate technical analysis and tooling published by defenders showed that BlackCat binaries embed configurable options for ransom notes, propagation, encryption behavior, and virtualization-focused disruption, underscoring how affiliates adapt the malware to different victim environments.
Aug 15, 2026