- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Seen
- to 2026
- Status
- Active
- ATT&CK
- G1043 · 48 techniques
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0382 · blackbyte
What it is
BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Hecamede
Tools
The tools and malware families the sources tie to it.
- AdFind
- Arp
- BLACKCOFFEE
- BlackByte 2.0 Ransomware
- BlackByte Ransomware
- BlackEnergy
- BlackHole
- BlackNix
- Blackshades
- Cobalt Strike
- CrossRat
- Cyber Eye RAT
- CyberGate
- Exbyte
- Mimikatz
- Net Devil
- PsExec
- Virus RAT
- Windows Remote Desktop
Sources
- MITRE ATT&CK attack.mitre.org