BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.12345
- FBI BlackByte 2022
- Picus BlackByte 2022
- Symantec BlackByte 2022
- Microsoft BlackByte 2023
- Cisco BlackByte 2024
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | BlackByte | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Hecamede | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1482 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.008 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1134.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1614.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055.012 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1491.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1490 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1480 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2024 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003 | OS Credential Dumping | — |
| T1012 | Query Registry | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1036.008 | Masquerade File Type | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1053.005 | Scheduled Task | — |
| T1055 | Process Injection | — |
| T1055.012 | Process Hollowing | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1070.004 | File Deletion | — |
| T1071.001 | Web Protocols | — |
| T1078 | Valid Accounts | — |
| T1078.002 | Domain Accounts | — |
| T1082 | System Information Discovery | — |
| T1087.002 | Domain Account | — |
| T1105 | Ingress Tool Transfer | — |
| T1112 | Modify Registry | — |
| T1134.003 | Make and Impersonate Token | — |
| T1135 | Network Share Discovery | — |
| T1136.002 | Domain Account | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1219 | Remote Access Tools | — |
| T1480 | Execution Guardrails | — |
| T1482 | Domain Trust Discovery | — |
| T1486 | Data Encrypted for Impact | — |
| T1490 | Inhibit System Recovery | — |
| T1491.001 | Internal Defacement | — |
| T1505.003 | Web Shell | — |
| T1518.001 | Security Software Discovery | — |
| T1543.003 | Windows Service | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1560 | Archive Collected Data | — |
| T1567 | Exfiltration Over Web Service | — |
| T1569.002 | Service Execution | — |
| T1570 | Lateral Tool Transfer | — |
| T1583.003 | Virtual Private Server | — |
| T1608.001 | Upload Malware | — |
| T1614.001 | System Language Discovery | — |
| T1685 | Disable or Modify Tools | — |
| T1686 | Disable or Modify System Firewall | — |
Aliases
BlackByte · Hecamede
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.