Forensia CTI Core

Profile

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.

MITRE ATT&CK ↗

Techniques

48 ATT&CK techniques attributed to this actor.

T1003 OS Credential Dumping T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1036.008 Masquerade File Type T1041 Exfiltration Over C2 Channel T1046 Network Service Discovery T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1055 Process Injection T1055.012 Process Hollowing T1059.001 PowerShell T1059.003 Windows Command Shell T1068 Exploitation for Privilege Escalation T1070.004 File Deletion T1071.001 Web Protocols T1078 Valid Accounts T1078.002 Domain Accounts T1082 System Information Discovery T1087.002 Domain Account T1105 Ingress Tool Transfer T1112 Modify Registry T1134.003 Make and Impersonate Token T1135 Network Share Discovery T1136.002 Domain Account T1140 Deobfuscate/Decode Files or Information T1190 Exploit Public-Facing Application T1219 Remote Access Tools T1480 Execution Guardrails T1482 Domain Trust Discovery T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1491.001 Internal Defacement T1505.003 Web Shell T1518.001 Security Software Discovery T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1560 Archive Collected Data T1567 Exfiltration Over Web Service T1569.002 Service Execution T1570 Lateral Tool Transfer T1583.003 Virtual Private Server T1608.001 Upload Malware T1614.001 System Language Discovery T1685 Disable or Modify Tools T1686 Disable or Modify System Firewall

Software

8 malware/tools attributed to this actor.

MimikatzPsExecArpCobalt StrikeAdFindExbyteBlackByte RansomwareBlackByte 2.0 Ransomware

Related corpus activity

10,302 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to BlackByte.

Indicator	Type	Family	Sev	Src
cve-2023-44976	cve	ransomware	85	2
cve-2026-1969	cve	—	85	1
cve-2025-68670	cve	—	85	2
cve-2026-3102	cve	—	85	3
cve-2025-2492	cve	—	85	2
cve-2021-29441	cve	—	85	1
cve-2026-22584	cve	—	85	2
cve-2025-11837	cve	—	85	2
cve-2025-34054	cve	—	85	4
cve-2014-2321	cve	—	85	1
cve-2020-17456	cve	—	85	1
cve-2020-22658	cve	—	85	2
cve-2017-18377	cve	—	85	1
cve-2021-25646	cve	—	85	1
cve-2025-66478	cve	—	85	2
cve-2025-0921	cve	—	85	2
cve-2021-27076	cve	—	85	1
cve-2013-3307	cve	—	85	2
cve-2016-5681	cve	—	85	2
cve-2016-15047	cve	—	85	4
cve-2024-1781	cve	—	85	1
cve-2018-8007	cve	—	85	1
cve-2025-23304	cve	—	85	2
cve-2021-4045	cve	—	85	1
cve-2020-22653	cve	—	85	2
cve-2022-47945	cve	—	85	1
cve-2025-34117	cve	—	85	1
cve-2026-4368	cve	ransomware	85	1
cve-2013-7471	cve	—	85	1
cve-2026-0740	cve	—	85	1

Showing the top 30 by severity of 10,302.