blackbyte Ransomware
Tracked since Oct 4, 2021
0
victims recorded
0
in the last 30 days
1
CVEs
—
Last activity
In MITRE ATT&CK MITRE ATT&CK
Group profile: BlackByte (G1043)
Ransomware cataloged as BlackByte Ransomware (S1180)
Used by: BlackByte G1043
Ransomware. Uses dropper written in JavaScript to deploy a .NET payload.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
- CVE-2024-37085 High · 7.2 KEV VMware ESXi Authentication Bypass Vulnerability
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1078.002 Valid Accounts: Domain AccountsT1190 Exploit Public-Facing Application Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled Task/Job: Scheduled TaskT1059.001 Command and Scripting Interpreter: PowerShellT1059.003 Command and Scripting Interpreter: Windows Command ShellT1569.002 System Services: Service Execution Persistence
T1053.005 Scheduled Task/Job: Scheduled TaskT1078 Valid AccountsT1078.002 Valid Accounts: Domain AccountsT1112 Modify RegistryT1136.002 Create Account: Domain AccountT1505.003 Server Software Component: Web ShellT1543.003 Create or Modify System Process: Windows ServiceT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Privilege Escalation
T1053.005 Scheduled Task/Job: Scheduled TaskT1055 Process InjectionT1055.012 Process Injection: Process HollowingT1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1078.002 Valid Accounts: Domain AccountsT1134.003 Access Token Manipulation: Make and Impersonate TokenT1543.003 Create or Modify System Process: Windows ServiceT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Stealth
T1036.008 Masquerading: Masquerade File TypeT1055 Process InjectionT1055.012 Process Injection: Process HollowingT1070.004 Indicator Removal: File DeletionT1078 Valid AccountsT1078.002 Valid Accounts: Domain AccountsT1134.003 Access Token Manipulation: Make and Impersonate TokenT1140 Deobfuscate/Decode Files or InformationT1480 Execution Guardrails Credential Access
T1003 OS Credential Dumping Discovery
T1012 Query RegistryT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1046 Network Service DiscoveryT1082 System Information DiscoveryT1087.002 Account Discovery: Domain AccountT1135 Network Share DiscoveryT1482 Domain Trust DiscoveryT1518.001 Software Discovery: Security Software DiscoveryT1614.001 System Location Discovery: System Language Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin SharesT1570 Lateral Tool Transfer Collection
T1560 Archive Collected Data Exfiltration
T1041 Exfiltration Over C2 ChannelT1567 Exfiltration Over Web Service Command and Control
T1071.001 Application Layer Protocol: Web ProtocolsT1105 Ingress Tool TransferT1219 Remote Access Tools Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System RecoveryT1491.001 Defacement: Internal Defacement Resource Development
T1583.003 Acquire Infrastructure: Virtual Private ServerT1608.001 Stage Capabilities: Upload Malware Defense Impairment
T1112 Modify RegistryT1685 Disable or Modify ToolsT1686 Disable or Modify System Firewall Observed tools
Defense Evasion
Dell Client driver (BYOVD) · GIGABYTE Motherboard driver (BYOVD) · MSI Afterburner driver (BYOVD) · Zemana Anti-Rootkit driver
Discovery Enum
PowerView · SoftPerfect NetScan
Offsec
Cobalt Strike · PowerShell Empire
RMM-Tools
AnyDesk
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live