Início / Ransomware Intelligence / Todos os grupos / blackbyte

blackbyte Ransomware

🔔 Criar alerta

Monitorado desde 04/10/2021

vítimas registradas

nos últimos 30 dias

CVEs

—

Última atividade

No MITRE ATT&CK MITRE ATT&CK

Perfil do grupo: BlackByte (G1043)

Ransomware catalogado como BlackByte Ransomware (S1180)

Usado por: BlackByte G1043

Ransomware. Uses dropper written in JavaScript to deploy a .NET payload.

Vulnerabilidades citadas para este grupo

CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.

CVE-2024-37085 Alta · 7.2 KEV VMware ESXi Authentication Bypass Vulnerability

Táticas e técnicas (MITRE ATT&CK)

Initial Access

T1078 Valid Accounts T1078.002 Valid Accounts: Domain Accounts T1190 Exploit Public-Facing Application

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task/Job: Scheduled Task T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell T1569.002 System Services: Service Execution

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task T1078 Valid Accounts T1078.002 Valid Accounts: Domain Accounts T1112 Modify Registry T1136.002 Create Account: Domain Account T1505.003 Server Software Component: Web Shell T1543.003 Create or Modify System Process: Windows Service T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled Task/Job: Scheduled Task T1055 Process Injection T1055.012 Process Injection: Process Hollowing T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1078.002 Valid Accounts: Domain Accounts T1134.003 Access Token Manipulation: Make and Impersonate Token T1543.003 Create or Modify System Process: Windows Service T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Stealth

T1036.008 Masquerading: Masquerade File Type T1055 Process Injection T1055.012 Process Injection: Process Hollowing T1070.004 Indicator Removal: File Deletion T1078 Valid Accounts T1078.002 Valid Accounts: Domain Accounts T1134.003 Access Token Manipulation: Make and Impersonate Token T1140 Deobfuscate/Decode Files or Information T1480 Execution Guardrails

Credential Access

T1003 OS Credential Dumping

Discovery

T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1046 Network Service Discovery T1082 System Information Discovery T1087.002 Account Discovery: Domain Account T1135 Network Share Discovery T1482 Domain Trust Discovery T1518.001 Software Discovery: Security Software Discovery T1614.001 System Location Discovery: System Language Discovery

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol T1021.002 Remote Services: SMB/Windows Admin Shares T1570 Lateral Tool Transfer

Collection

T1560 Archive Collected Data

Exfiltration

T1041 Exfiltration Over C2 Channel T1567 Exfiltration Over Web Service

Command and Control

T1071.001 Application Layer Protocol: Web Protocols T1105 Ingress Tool Transfer T1219 Remote Access Tools

Impact

T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1491.001 Defacement: Internal Defacement

Resource Development

T1583.003 Acquire Infrastructure: Virtual Private Server T1608.001 Stage Capabilities: Upload Malware

Defense Impairment

T1112 Modify Registry T1685 Disable or Modify Tools T1686 Disable or Modify System Firewall

Ferramentas observadas

Defense Evasion

Dell Client driver (BYOVD) · GIGABYTE Motherboard driver (BYOVD) · MSI Afterburner driver (BYOVD) · Zemana Anti-Rootkit driver

Discovery Enum

PowerView · SoftPerfect NetScan

Offsec

Cobalt Strike · PowerShell Empire

RMM-Tools

AnyDesk

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live