Home / Threat actors / BlackByte

BlackByte G1043

🔔 Create alert

Also known as: Hecamede

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

1

associated CVEs

62

Techniques

8

Malware and tools

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.

Ransomware operations linked to this group ransomware.live

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2024-37085 High · 7.2 KEV Ransomware VMware ESXi Authentication Bypass Vulnerability

“BlackByte has exploited CVE-2024-37085 in VMWare ESXi software for authentication bypass and subsequent privilege escalation.”

Techniques by tactic

Resource Development

T1583.003 Virtual Private Server T1608.001 Upload Malware

Initial Access

T1078 Valid Accounts T1078.002 Domain Accounts T1190 Exploit Public-Facing Application

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1569.002 Service Execution

Persistence

T1053.005 Scheduled Task T1078 Valid Accounts T1078.002 Domain Accounts T1112 Modify Registry T1136.002 Domain Account T1505.003 Web Shell T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled Task T1055 Process Injection T1055.012 Process Hollowing T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1078.002 Domain Accounts T1134.003 Make and Impersonate Token T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Stealth

T1036.008 Masquerade File Type T1055 Process Injection T1055.012 Process Hollowing T1070.004 File Deletion T1078 Valid Accounts T1078.002 Domain Accounts T1134.003 Make and Impersonate Token T1140 Deobfuscate/Decode Files or Information T1480 Execution Guardrails

Defense Impairment

T1112 Modify Registry T1685 Disable or Modify Tools T1686 Disable or Modify System Firewall

Credential Access

T1003 OS Credential Dumping

Discovery

T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1046 Network Service Discovery T1082 System Information Discovery T1087.002 Domain Account T1135 Network Share Discovery T1482 Domain Trust Discovery T1518.001 Security Software Discovery T1614.001 System Language Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1570 Lateral Tool Transfer

Collection

T1560 Archive Collected Data

Command and Control

T1071.001 Web Protocols T1105 Ingress Tool Transfer T1219 Remote Access Tools

Exfiltration

T1041 Exfiltration Over C2 Channel T1567 Exfiltration Over Web Service

Impact

T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1491.001 Internal Defacement

Malware and tools

BlackByte 2.0 RansomwareMalwareS1181
BlackByte RansomwareMalwareS1180
Cobalt StrikeMalwareS0154
ExbyteMalwareS1179
AdFindToolS0552
ArpToolS0099
MimikatzToolS0002
PsExecToolS0029

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.