Início / Grupos de ameaça / BlackByte

BlackByte G1043

🔔 Criar alerta

Também conhecido como: Hecamede

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

1

CVEs associadas

62

Técnicas

8

Malwares e ferramentas

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.

Operações de ransomware ligadas a este grupo ransomware.live

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2024-37085 Alta · 7.2 KEV Ransomware VMware ESXi Authentication Bypass Vulnerability

“BlackByte has exploited CVE-2024-37085 in VMWare ESXi software for authentication bypass and subsequent privilege escalation.”

Técnicas por tática

Desenvolvimento de recursos

T1583.003 Virtual Private Server T1608.001 Upload Malware

Acesso inicial

T1078 Valid Accounts T1078.002 Domain Accounts T1190 Exploit Public-Facing Application

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1569.002 Service Execution

Persistência

T1053.005 Scheduled Task T1078 Valid Accounts T1078.002 Domain Accounts T1112 Modify Registry T1136.002 Domain Account T1505.003 Web Shell T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1053.005 Scheduled Task T1055 Process Injection T1055.012 Process Hollowing T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1078.002 Domain Accounts T1134.003 Make and Impersonate Token T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Furtividade

T1036.008 Masquerade File Type T1055 Process Injection T1055.012 Process Hollowing T1070.004 File Deletion T1078 Valid Accounts T1078.002 Domain Accounts T1134.003 Make and Impersonate Token T1140 Deobfuscate/Decode Files or Information T1480 Execution Guardrails

Comprometimento de defesas

T1112 Modify Registry T1685 Disable or Modify Tools T1686 Disable or Modify System Firewall

Acesso a credenciais

T1003 OS Credential Dumping

Descoberta

T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1046 Network Service Discovery T1082 System Information Discovery T1087.002 Domain Account T1135 Network Share Discovery T1482 Domain Trust Discovery T1518.001 Security Software Discovery T1614.001 System Language Discovery

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1570 Lateral Tool Transfer

Coleta

T1560 Archive Collected Data

Comando e controle

T1071.001 Web Protocols T1105 Ingress Tool Transfer T1219 Remote Access Tools

Exfiltração

T1041 Exfiltration Over C2 Channel T1567 Exfiltration Over Web Service

Impacto

T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1491.001 Internal Defacement

Malwares e ferramentas

BlackByte 2.0 RansomwareMalwareS1181
BlackByte RansomwareMalwareS1180
Cobalt StrikeMalwareS0154
ExbyteMalwareS1179
AdFindFerramentaS0552
ArpFerramentaS0099
MimikatzFerramentaS0002
PsExecFerramentaS0029

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.