BlackByte

Also known as: hecamede

BlackByte ransomware was first observed in July 2021 and operates as a Ransomware-as-a-Service (RaaS). It uses a double-extortion model—encrypting victim files while exfiltrating sensitive data for publication on its Tor-based leak site. The ransomware is written in C# and uses AES-256 for file encryption, with keys protected by RSA public-key encryption. Early variants exploited the ProxyShell vulnerability in Microsoft Exchange servers for initial access, but later campaigns have leveraged phishing, malicious attachments, and vulnerable internet-facing systems. BlackByte appends extensions such as .blackbyte or .blackbyte2.0 to encrypted files and leaves ransom notes (BlackByte_restoremyfiles.txt) instructing victims to contact them via Tor. The group has targeted organizations worldwide, including critical infrastructure, manufacturing, and government sectors. In February 2022, the FBI and USSS released a joint advisory warning about BlackByte’s impact and offering detection signatures.

Victims in the last 90 days0

Most affected countries

No data yet.

Most affected sectors

No data yet.

Priority mitigations

MITRE ATT&CK mitigations that cover the most techniques used by this group.

Privileged Account Management (13 techniques covered)
User Account Management (11 techniques covered)
Operating System Configuration (8 techniques covered)
Execution Prevention (8 techniques covered)
Behavior Prevention on Endpoint (8 techniques covered)
Audit (7 techniques covered)
Network Intrusion Prevention (6 techniques covered)
Filter Network Traffic (6 techniques covered)

MITRE ATT&CK techniques

T1082 · System Information Discovery T1016 · System Network Configuration Discovery T1046 · Network Service Discovery T1105 · Ingress Tool Transfer T1482 · Domain Trust Discovery T1686 · Disable or Modify System Firewall T1036.008 · Masquerade File Type T1053.005 · Scheduled Task T1134.003 · Make and Impersonate Token T1070.004 · File Deletion T1543.003 · Windows Service T1021.001 · Remote Desktop Protocol T1685 · Disable or Modify Tools T1614.001 · System Language Discovery T1560 · Archive Collected Data T1059.003 · Windows Command Shell T1136.002 · Domain Account T1112 · Modify Registry T1055.012 · Process Hollowing T1491.001 · Internal Defacement T1071.001 · Web Protocols T1087.002 · Domain Account T1570 · Lateral Tool Transfer T1583.003 · Virtual Private Server T1190 · Exploit Public-Facing Application T1608.001 · Upload Malware T1490 · Inhibit System Recovery T1012 · Query Registry T1059.001 · PowerShell T1041 · Exfiltration Over C2 Channel T1569.002 · Service Execution T1135 · Network Share Discovery T1140 · Deobfuscate/Decode Files or Information T1068 · Exploitation for Privilege Escalation T1505.003 · Web Shell T1078 · Valid Accounts T1567 · Exfiltration Over Web Service T1055 · Process Injection T1021.002 · SMB/Windows Admin Shares T1078.002 · Domain Accounts T1547.001 · Registry Run Keys / Startup Folder T1480 · Execution Guardrails T1486 · Data Encrypted for Impact T1518.001 · Security Software Discovery T1219 · Remote Access Tools T1047 · Windows Management Instrumentation T1018 · Remote System Discovery T1003 · OS Credential Dumping

Recent victims

No data yet.

Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.

Sources: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.