Microsoft BlackByte 2023

BlackByte used tools such as Cobalt Strike and Mimikatz to dump credentials from victim systems.

BlackByte used tools such as Arp to pull system network information and identify connected devices.

BlackByte has used RDP to access other hosts within victim networks.

BlackByte used SMB file shares to distribute payloads throughout victim networks, including BlackByte ransomware variants during wormable operations.

BlackByte transmitted collected victim host information via HTTP POST to command and control infrastructure.

BlackByte has used tools such as NetScan to enumerate network services in victim environments.

BlackByte 2.0 Ransomware injects into a newly-created `svchost.exe` process prior to device encryption.

BlackByte used process hollowing for defense evasion purposes.

BlackByte used encoded PowerShell commands during operations. BlackByte has used remote PowerShell commands in victim networks.

BlackByte 2.0 Ransomware exploits a vulnerability in the RTCore64.sys driver (CVE-2019-16098) to enable privilege escalation and defense evasion when run as a service.

Exbyte checks whether the process is running with privileged local access during execution.

BlackByte deleted ransomware executables post-encryption.

BlackByte 2.0 Ransomware deletes itself following device encryption.

Exbyte will self-delete if a hard-coded configuration file is not found.

BlackByte 2.0 Ransomware can timestomp files for defense evasion and anti-forensics purposes.

BlackByte collected victim device information then transmitted this via HTTP POST to command and control infrastructure.

BlackByte captured credentials for or impersonated domain administration users.

BlackByte used various system commands and tools to pull system information during operations.

BlackByte has used tools such as AdFind to identify and enumerate domain accounts.

BlackByte has transferred tools such as Cobalt Strike to victim environments from file sharing and hosting websites.

Exbyte calls `ShellExecuteW` with the `IpOperation` parameter `RunAs` to launch `explorer.exe` with elevated privileges.

BlackByte 2.0 Ransomware modifies the victim Registry to allow for elevated execution.

BlackByte constructed a valid authentication token following Microsoft Exchange exploitation to allow for follow-on privileged command execution.

BlackByte 2.0 Ransomware can identify network shares connected to the victim machine.

Exbyte decodes and decrypts data stored in the configuration file with a key provided on the command line during execution.

BlackByte exploited vulnerabilities such as ProxyLogon and ProxyShell for initial access to victim environments.

BlackByte has used tools such as AnyDesk in victim environments.

Exbyte checks for the presence of a configuration file before completing execution.

BlackByte enumerated Active Directory information and trust relationships during operations.

BlackByte has encrypted victim files for ransom. Early versions of BlackByte ransomware used a common key for encryption, but later versions use unique keys per victim.

BlackByte 2.0 Ransomware is a ransomware variant associated with BlackByte operations.

BlackByte 2.0 Ransomware can terminate running services.

BlackByte 2.0 Ransomware modifies volume shadow copies during execution in a way that destroys them on the victim machine.

BlackByte has used ASPX web shells following exploitation of vulnerabilities in services such as Microsoft Exchange.

BlackByte enumerated installed security products during operations.

BlackByte modified multiple services on victim machines to enable encryption operations. BlackByte has installed tools such as AnyDesk as a service on victim machines.

BlackByte has used Registry Run keys for persistence.

Exbyte exfiltrates collected data to online file hosting sites such as `Mega.co.nz`.

BlackByte 2.0 Ransomware executes as a service when deployed.

BlackByte has staged tools such as Cobalt Strike at public file sharing and hosting sites.

BlackByte 2.0 Ransomware modifies the Windows firewall during execution.