Blackbyte
| RaaS
Ransomware. Uses dropper written in JavaScript to deploy a .NET payload.
Victims
147
First Discovered
2021-10-04
victim
Last Discovered
2025-07-30
victim
Inactive Since
1yr
more than
Avg Delay
57.5
days
Infostealer
58.2%
victims with domain
Countries
24
hit
Known Locations (9)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
No | 2026-05-27T11:07:01 |
6iaj3efye3q62xjgfxyegrufhewxew7yt4scxjd45tlfafyja6q4ctqd.onion
|
||||
|
BlackByte BLOG | No | 2026-04-28T07:23:49 |
f5uzduboq4fa2xkjloprmctk7ve3dm46ff7aniis66cbekakvksxgeqd.onion
|
|||
|
BlackByte BLOG | No | 2026-04-28T07:26:22 |
dlyo7r3n4qy5fzv4645nddjwarj7wjdd6wzckomcyc7akskkxp4glcad.onion
|
|||
|
BlackByte BLOG | No | 2026-04-28T07:28:55 |
fl3xpz5bmgzxy4fmebhgsbycgnz24uosp3u4g33oiln627qq3gyw37ad.onion
|
|||
|
BlackByte BLOG | No | 2026-04-28T07:31:16 |
ce6roic2ykdjunyzazsxmjpz5wsar4pflpoqzntyww5c2eskcp7dq4yd.onion
|
|||
|
BB Auction | No | 2026-04-28T07:32:31 |
jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion
|
|||
|
BB Auction | No | 2026-04-28T07:33:46 |
53d5skw4ypzku4bfq2tk2mr3xh5yqrzss25sooiubmjz67lb3gdivcad.onion
|
|||
|
File downloader | No | 2026-04-28T07:34:29 |
tj3ty2q5jm5au3bmd2embtjscd3qjt7nfio2o7cr6moyy5kgil5pieqd.onion
|
|||
|
BB Auction | No | 2026-04-28T07:36:04 |
dounczge5jhw4iztnnpzp54kd4ot3tikhjsimurtcewqssgye6vvrhqd.onion
|
Target
Top 5 Activity Sectors
- Manufacturing 31
- Professional Services 22
- Retail & E-Commerce 20
- Technology 11
- Agriculture and Food Production 11
Top 5 Countries
-
United States
14
-
Brazil
4
-
United Kingdom
3
-
Sweden
2
-
Poland
2
Heatmap
Ransom Notes (4)
Tools Used
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
PowerView
SoftPerfect NetScan
|
AnyDesk
|
Dell Client driver (BYOVD)
GIGABYTE Motherboard driver (BYOVD)
MSI Afterburner driver (BYOVD)
Zemana Anti-Rootkit driver
|
|
Cobalt Strike
PowerShell Empire
|
|
|
|
TTPs Matrix (14)
| Initial Access | Execution | Persistence | Privilege Escalation | Stealth | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Impact | Resource Development | Defense Impairment |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Windows Management Instrumentation | Scheduled Task/Job: Scheduled Task | Scheduled Task/Job: Scheduled Task | Masquerading: Masquerade File Type | OS Credential Dumping | Query Registry | Remote Services: Remote Desktop Protocol | Archive Collected Data | Exfiltration Over C2 Channel | Application Layer Protocol: Web Protocols | Data Encrypted for Impact | Acquire Infrastructure: Virtual Private Server | Modify Registry |
| Valid Accounts: Domain Accounts | Scheduled Task/Job: Scheduled Task | Valid Accounts | Process Injection | Process Injection | System Network Configuration Discovery | Remote Services: SMB/Windows Admin Shares | Exfiltration Over Web Service | Ingress Tool Transfer | Inhibit System Recovery | Stage Capabilities: Upload Malware | Disable or Modify Tools | ||
| Exploit Public-Facing Application | Command and Scripting Interpreter: PowerShell | Valid Accounts: Domain Accounts | Process Injection: Process Hollowing | Process Injection: Process Hollowing | Remote System Discovery | Lateral Tool Transfer | Remote Access Tools | Defacement: Internal Defacement | Disable or Modify System Firewall | ||||
| Command and Scripting Interpreter: Windows Command Shell | Modify Registry | Exploitation for Privilege Escalation | Indicator Removal: File Deletion | Network Service Discovery | |||||||||
| System Services: Service Execution | Create Account: Domain Account | Valid Accounts | Valid Accounts | System Information Discovery | |||||||||
| Server Software Component: Web Shell | Valid Accounts: Domain Accounts | Valid Accounts: Domain Accounts | Account Discovery: Domain Account | ||||||||||
| Create or Modify System Process: Windows Service | Access Token Manipulation: Make and Impersonate Token | Access Token Manipulation: Make and Impersonate Token | Network Share Discovery | ||||||||||
| Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | Create or Modify System Process: Windows Service | Deobfuscate/Decode Files or Information | Domain Trust Discovery | ||||||||||
| Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | Execution Guardrails | Software Discovery: Security Software Discovery | |||||||||||
| System Location Discovery: System Language Discovery |
KQL Query (1)
-
BlackByte – RTCore64.sys (GIGABYTE Driver) BYOVD Load
Defense Evasion
Sentinel
T1211
YARA Rules (1)
Victims (147)
Dara Pharmaceutical designs, develops, and manufactures packaging equipment for washing, sterilizing…
In 1979, Bill Lees vision became reality when he opened the first office of Lee & Associates in Oran…
Founded in 1982, The Towne Mortgage Family of Companies has more than 40 years of experience in the …
Founded in 2008, GreenLight Bioscience is a pre-commercial stage synthetic biology company with a pr…
ARK Consultancy Limited is a leading management and technical consultancy specializing in social hou…
Founded in 1933, Modern Automotive is a family owned and operated network of dealerships located thr…
The Encina Wastewater Authority (EWA) is a public agency located in Carlsbad, California. EWA provid…
Meridian Cooperative is the only enterprise solution that delivers flexible leading-edge software, s…
Hoteles Xcaret offers the best lodging experiences in Riviera Maya. Our hotels have been designed to…
Alps Alpine, a leading manufacturer of electronic components and automotive infotainment systems, ha…
Since 1926, Kirby Risk has remained committed to the concept of sacrificial service by going above a…
FOCUS was founded in 1998 with the simple vision of delivering great cost savings and compliance ser…
The Chambersburg Area School District covers 250 square miles in Franklin County, Pennsylvania, near…
valign designs, manufactures, and delivers the highest quality, precision-machined tools and implant…
Established in 1958, Brett Martin is a global player supplying specialist plastic products for the c…
Kisco Senior Living was founded in 1990. This company provides elderly care services in the form of …
At Multistack, we recognize and respect the importance of providing HVAC solutions that promote ener…
Nebraskaland, Inc. distributes and sells seafood and meat products to customers in New York metro ar…
Founded in 1964, Texwipe is a company that specializes in manufacturing cleanroom products. The comp…
Yamaha Corporation of America manufactures a complete line of musical instruments, professional audi…
Fiege Sp. z o.o. is a company based in Poland, with its head office in Warsaw. The enterprise operat…
The City of Augusta, GA, headquartered in Augusta, and established in 1736, is a consolidated city-c…
Magic Aire is an independent Manufacturer of Heating, Ventilation and Air Conditioning (HVAC) compon…
We are Sterling, a full service creative and production agency, who think about things a little diff…
PRESS-SERVICE Monitoring Mediów is a company that operates in the Security and Investigations indust…
Dacotah Paper Co., doing business as Range Paper Bemidji Paper & Janitorial Supply, operates as a wh…
Easy Automation Inc. (EAI) based in Welcome, Minnesota, specializes in serving the feed automation n…
Esperanza Viva Jóvenes de México is a company that operates in the Civic & Social Organization indus…
Gulliver International is a Japan-based company that operates in three business segments. The Pre-ow…
S-IMS specialized in providing solutions or data integration. SaoBacDau Group acquired 99 % of Netpr…
Through years of growth and change, one thing has always remained: our passion for fabrics. Création…
Crown Grinding and Machining has been providing quality material and service since 1999. Our modern …
Cementos Bio Bio S.A. manufactures and sells cement in Chile and internationally. It provides clinke…
With a 2020 population of over 11,000 Collegedale is situated in eastern Hamilton County 15 minutes …
Kelly Group has been at the forefront of the telecommunications industry for more than 35 years, ins…
The Company’s rich heritage and continued desire to bring the very best communications services and …
Falcon created the management company of professionals to provide operational expertise and administ…
Since 1976, Wagner has been selling and renting quality Cat machines used in heavy construction, bui…
The Inland Group of Companies is a multi-national collective of premier aviation services providers.…
Our ServicesLeveraging our OEM expertise and 50+ years of experience, we provide comprehensive fleet…
Ellison Technologies is a provider of advanced machining solutions to North American metal-cutting m…
From our earliest days in Kansas City, we have remained brokerage leaders in the real estate industr…
n a property greater than 39,000 square meters, with more than 21,000 square meters of covered facil…
WE ARE PETERSON & HANSON BYGGNADS ABWith environment, competence and well-being at the top of the ag…
Broto Legal was founded in the 1970s and engages in the commercialization of rice, beans, potatoes, …
Asahi Group Company Limited was founded in the 1970s in Hong Kong. For more than 40 years, we have w…
The Municipality of Chihuahua is a local government in the northern Mexican state of Chihuahua that …
Mary’s Free Range Chickens is proud to be family owned and operated since 1954. Mary's sons, David …
Cheese engages all the senses. We believe that an amazing specialty food deserves an equally compell…
Almoayed ICT is an Information Technology (IT) and Telecommunications (Telecom) solution provider, h…
Biggest News Source for News in Uganda and the East African Region ,Breaking news in Uganda and Dail…
South Pacific Inc. (SPI) is a 100% Filipino-owned company engaged in the downstream business of LPG …
Since starting business in 1962, Davin Industries has earned an enviable reputation as an industry l…
TIB Development Bank Limited was established in November 1970 initially by the Parliamentary Act, th…
The headquarters is located in Sinzig/Rhine, where about 30 employees can rely on more than two deca…
Alan Smith Pool Plastering, Inc. has been a swimming pool contractor, and an active member of the Or…
Torin Drive, the specialized manufacturer of the elevator traction machines, the lift components, th…
Grande Stevens Law Firm, which bears the name of its founder, Franzo Grande Stevens, has provided le…
