BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.12345
- FBI BlackByte 2022
- Picus BlackByte 2022
- Symantec BlackByte 2022
- Microsoft BlackByte 2023
- Cisco BlackByte 2024
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1082 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1482 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.008 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1134.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1614.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055.012 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1491.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1490 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1480 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2024 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003 | OS Credential Dumping | — |
| T1012 | Query Registry | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1036.008 | Masquerade File Type | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1053.005 | Scheduled Task | — |
| T1055 | Process Injection | — |
| T1055.012 | Process Hollowing | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1070.004 | File Deletion | — |
| T1071.001 | Web Protocols | — |
| T1078 | Valid Accounts | — |
| T1078.002 | Domain Accounts | — |
| T1082 | System Information Discovery | — |
| T1087.002 | Domain Account | — |
| T1105 | Ingress Tool Transfer | — |
| T1112 | Modify Registry | — |
| T1134.003 | Make and Impersonate Token | — |
| T1135 | Network Share Discovery | — |
| T1136.002 | Domain Account | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1219 | Remote Access Tools | — |
| T1480 | Execution Guardrails | — |
| T1482 | Domain Trust Discovery | — |
| T1486 | Data Encrypted for Impact | — |
| T1490 | Inhibit System Recovery | — |
| T1491.001 | Internal Defacement | — |
| T1505.003 | Web Shell | — |
| T1518.001 | Security Software Discovery | — |
| T1543.003 | Windows Service | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1560 | Archive Collected Data | — |
| T1567 | Exfiltration Over Web Service | — |
| T1569.002 | Service Execution | — |
| T1570 | Lateral Tool Transfer | — |
| T1583.003 | Virtual Private Server | — |
| T1608.001 | Upload Malware | — |
| T1614.001 | System Language Discovery | — |
| T1685 | Disable or Modify Tools | — |
| T1686 | Disable or Modify System Firewall | — |
别名
BlackByte · Hecamede
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。