Picus BlackByte 2022

BlackByte used tools such as Cobalt Strike and Mimikatz to dump credentials from victim systems.

BlackByte queried registry values to determine system language settings.

BlackByte used tools such as Arp to identify remotely-connected devices.

BlackByte used SMB file shares to distribute payloads throughout victim networks, including BlackByte ransomware variants during wormable operations.

BlackByte created scheduled tasks for payload execution.

BlackByte has injected Cobalt Strike into `wuauclt.exe` during intrusions. BlackByte has injected ransomware into `svchost.exe` before encryption.

BlackByte deleted ransomware executables post-encryption.

BlackByte performed Registry modifications to escalate privileges and disable security tools.

BlackByte has encoded commands in base64-encoded sections concatenated together in PowerShell. BlackByte uses PowerShell commands to disable Windows Defender.

BlackByte exploited vulnerabilities such as ProxyLogon and ProxyShell for initial access to victim environments.

BlackByte has used tools such as AnyDesk in victim environments.

BlackByte stopped execution if identified language settings on victim machines was Russian or one of several language associated with former Soviet republics. BlackByte has used ransomware variants requiring a key passed on the command line for the malware to execute.

BlackByte has encrypted victim files for ransom. Early versions of BlackByte ransomware used a common key for encryption, but later versions use unique keys per victim.

BlackByte resized and deleted volume shadow copy files to prevent system recovery after encryption.

BlackByte has used ASPX web shells following exploitation of vulnerabilities in services such as Microsoft Exchange.

BlackByte compressed data collected from victim environments prior to exfiltration.

BlackByte has used services such as `anonymfiles.com` and `file.io` to exfiltrate victim data.

BlackByte transfered tools such as Cobalt Strike and the AnyDesk remote access tool during operations using SMB shares.

BlackByte identified system language settings to determine follow-on execution.

BlackByte disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.

BlackByte modified firewall rules on victim machines to enable remote system discovery.