FBI BlackByte 2022

BlackByte used tools such as Arp to pull system network information and identify connected devices.

BlackByte used tools such as Arp to identify remotely-connected devices.

BlackByte masqueraded configuration files containing encryption keys as PNG files.

BlackByte used WMI to delete Volume Shadow Copies on victim machines.

BlackByte created scheduled tasks for payload execution.

BlackByte used encoded PowerShell commands during operations. BlackByte has used remote PowerShell commands in victim networks.

BlackByte executed ransomware using the Windows command shell.

BlackByte used various system commands and tools to pull system information during operations.

BlackByte has encoded commands in base64-encoded sections concatenated together in PowerShell. BlackByte uses PowerShell commands to disable Windows Defender.

BlackByte exploited vulnerabilities such as ProxyLogon and ProxyShell for initial access to victim environments.

BlackByte enumerated Active Directory information and trust relationships during operations.

BlackByte has encrypted victim files for ransom. Early versions of BlackByte ransomware used a common key for encryption, but later versions use unique keys per victim.

BlackByte left ransom notes in all directories where encryption takes place.

BlackByte staged encryption keys on virtual private servers operated by the adversary.

BlackByte disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.