RansomwareTargets BrazilG1043

BlackByte

Also known as: Hecamede

Follow this group

E-mail alert on newly attributed CVEs, new victims in Brazil and verified incidents.

About the group

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity75
Impact: Critical
T1190T1047T1136.002T1068T1560T1041ENTRYInitial accessExploitPublic-Facing App…EXECExecutionWindows ManagementInstrumentationPERSPersistenceDomain AccountPRIVPrivilege escalationExploitation forPrivilege Escalat…COLLCollectionArchive CollectedDataEXFILExfiltrationExfiltration OverC2 ChannelIMPACTImpactData Encrypted forImpact

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 48

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development
Virtual Private ServerUpload Malware
Initial access
Exploit Public-Facing Application
Execution
Windows Management InstrumentationScheduled TaskPowerShellWindows Command ShellService Execution
Persistence
Domain AccountWeb ShellWindows ServiceRegistry Run Keys / Startup Folder
Privilege escalation
Exploitation for Privilege Escalation
Credential access
OS Credential Dumping
Discovery
Query RegistrySystem Network Configuration DiscoveryRemote System DiscoveryNetwork Service DiscoverySystem Information DiscoveryDomain AccountNetwork Share DiscoveryDomain Trust DiscoverySecurity Software DiscoverySystem Language Discovery
Lateral movement
Remote Desktop ProtocolSMB/Windows Admin SharesLateral Tool Transfer
Collection
Archive Collected Data
Command and control
Web ProtocolsIngress Tool TransferRemote Access Tools
Exfiltration
Exfiltration Over C2 ChannelExfiltration Over Web Service
Impact
Data Encrypted for ImpactInhibit System RecoveryInternal Defacement
defense-impairment
Modify RegistryDisable or Modify ToolsDisable or Modify System Firewall
stealth
Masquerade File TypeProcess InjectionProcess HollowingFile DeletionValid AccountsDomain AccountsMake and Impersonate TokenDeobfuscate/Decode Files or InformationExecution Guardrails

Arsenal and tactics

What the group uses and how it attacks, from the group's public profile, compiled from public reporting. The CVEs in that profile are in the CVEs section, with the source next to them.

Tools

Offensive tools
Cobalt StrikePowerShell Empire
Discovery
PowerViewSoftPerfect NetScan
Defense evasion
Dell Client driver (BYOVD)GIGABYTE Motherboard driver (BYOVD)MSI Afterburner driver (BYOVD)Zemana Anti-Rootkit driver
Remote access (RMM)
AnyDesk

How the group attacks

  • Initial Access TA0001
    • T1078 Valid Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) has gained access to victim environments through legitimate VPN credentials.(Citation: Cisco BlackByte 2024)
    • T1078.002 Valid Accounts: Domain Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) captured credentials for or impersonated domain administration users.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1190 Exploit Public-Facing Application: [BlackByte](https://attack.mitre.org/groups/G1043) exploited vulnerabilities such as ProxyLogon and ProxyShell for initial access to victim environments.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)
  • Execution TA0002
    • T1047 Windows Management Instrumentation: [BlackByte](https://attack.mitre.org/groups/G1043) used WMI to delete Volume Shadow Copies on victim machines.(Citation: FBI BlackByte 2022)
    • T1053.005 Scheduled Task/Job: Scheduled Task: [BlackByte](https://attack.mitre.org/groups/G1043) created scheduled tasks for payload execution.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)
    • T1059.001 Command and Scripting Interpreter: PowerShell: [BlackByte](https://attack.mitre.org/groups/G1043) used encoded PowerShell commands during operations.(Citation: FBI BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has used remote PowerShell commands in victim networks.(Citation: Microsoft BlackByte 2023)
    • T1059.003 Command and Scripting Interpreter: Windows Command Shell: [BlackByte](https://attack.mitre.org/groups/G1043) executed ransomware using the Windows command shell.(Citation: FBI BlackByte 2022)
    • T1569.002 System Services: Service Execution: [BlackByte](https://attack.mitre.org/groups/G1043) created malicious services for ransomware execution.(Citation: Symantec BlackByte 2022)(Citation: Cisco BlackByte 2024)
  • Persistence TA0003
    • T1053.005 Scheduled Task/Job: Scheduled Task: [BlackByte](https://attack.mitre.org/groups/G1043) created scheduled tasks for payload execution.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)
    • T1078 Valid Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) has gained access to victim environments through legitimate VPN credentials.(Citation: Cisco BlackByte 2024)
    • T1078.002 Valid Accounts: Domain Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) captured credentials for or impersonated domain administration users.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1112 Modify Registry: [BlackByte](https://attack.mitre.org/groups/G1043) performed Registry modifications to escalate privileges and disable security tools.(Citation: Picus BlackByte 2022)(Citation: Cisco BlackByte 2024)
    • T1136.002 Create Account: Domain Account: [BlackByte](https://attack.mitre.org/groups/G1043) created privileged domain accounts during intrusions.(Citation: Cisco BlackByte 2024)
    • T1505.003 Server Software Component: Web Shell: [BlackByte](https://attack.mitre.org/groups/G1043) has used ASPX web shells following exploitation of vulnerabilities in services such as Microsoft Exchange.(Citation: Picus BlackByte 2022)(Citation: Microsoft BlackByte 2023)
    • T1543.003 Create or Modify System Process: Windows Service: [BlackByte](https://attack.mitre.org/groups/G1043) modified multiple services on victim machines to enable encryption operations.(Citation: Symantec BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has installed tools such as AnyDesk as a service on victim machines.(Citation: Microsoft BlackByte 2023)
    • T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder: [BlackByte](https://attack.mitre.org/groups/G1043) has used Registry Run keys for persistence.(Citation: Microsoft BlackByte 2023)
  • Privilege Escalation TA0004
    • T1053.005 Scheduled Task/Job: Scheduled Task: [BlackByte](https://attack.mitre.org/groups/G1043) created scheduled tasks for payload execution.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)
    • T1055 Process Injection: [BlackByte](https://attack.mitre.org/groups/G1043) has injected [Cobalt Strike](https://attack.mitre.org/software/S0154) into `wuauclt.exe` during intrusions.(Citation: Picus BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has injected ransomware into `svchost.exe` before encryption.(Citation: Symantec BlackByte 2022)
    • T1055.012 Process Injection: Process Hollowing: [BlackByte](https://attack.mitre.org/groups/G1043) used process hollowing for defense evasion purposes.(Citation: Microsoft BlackByte 2023)
    • T1068 Exploitation for Privilege Escalation: [BlackByte](https://attack.mitre.org/groups/G1043) has exploited CVE-2024-37085 in VMWare ESXi software for authentication bypass and subsequent privilege escalation.(Citation: Cisco BlackByte 2024)
    • T1078 Valid Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) has gained access to victim environments through legitimate VPN credentials.(Citation: Cisco BlackByte 2024)
    • T1078.002 Valid Accounts: Domain Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) captured credentials for or impersonated domain administration users.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1134.003 Access Token Manipulation: Make and Impersonate Token: [BlackByte](https://attack.mitre.org/groups/G1043) constructed a valid authentication token following Microsoft Exchange exploitation to allow for follow-on privileged command execution.(Citation: Microsoft BlackByte 2023)
    • T1543.003 Create or Modify System Process: Windows Service: [BlackByte](https://attack.mitre.org/groups/G1043) modified multiple services on victim machines to enable encryption operations.(Citation: Symantec BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has installed tools such as AnyDesk as a service on victim machines.(Citation: Microsoft BlackByte 2023)
    • T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder: [BlackByte](https://attack.mitre.org/groups/G1043) has used Registry Run keys for persistence.(Citation: Microsoft BlackByte 2023)
  • Stealth TA0005
    • T1036.008 Masquerading: Masquerade File Type: [BlackByte](https://attack.mitre.org/groups/G1043) masqueraded configuration files containing encryption keys as PNG files.(Citation: FBI BlackByte 2022)
    • T1055 Process Injection: [BlackByte](https://attack.mitre.org/groups/G1043) has injected [Cobalt Strike](https://attack.mitre.org/software/S0154) into `wuauclt.exe` during intrusions.(Citation: Picus BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has injected ransomware into `svchost.exe` before encryption.(Citation: Symantec BlackByte 2022)
    • T1055.012 Process Injection: Process Hollowing: [BlackByte](https://attack.mitre.org/groups/G1043) used process hollowing for defense evasion purposes.(Citation: Microsoft BlackByte 2023)
    • T1070.004 Indicator Removal: File Deletion: [BlackByte](https://attack.mitre.org/groups/G1043) deleted ransomware executables post-encryption.(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1078 Valid Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) has gained access to victim environments through legitimate VPN credentials.(Citation: Cisco BlackByte 2024)
    • T1078.002 Valid Accounts: Domain Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) captured credentials for or impersonated domain administration users.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1134.003 Access Token Manipulation: Make and Impersonate Token: [BlackByte](https://attack.mitre.org/groups/G1043) constructed a valid authentication token following Microsoft Exchange exploitation to allow for follow-on privileged command execution.(Citation: Microsoft BlackByte 2023)
    • T1140 Deobfuscate/Decode Files or Information: [BlackByte](https://attack.mitre.org/groups/G1043) has encoded commands in base64-encoded sections concatenated together in PowerShell.(Citation: FBI BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) uses PowerShell commands to disable Windows Defender.(Citation: Picus BlackByte 2022)
    • T1480 Execution Guardrails: [BlackByte](https://attack.mitre.org/groups/G1043) stopped execution if identified language settings on victim machines was Russian or one of several language associated with former Soviet republics.(Citation: Picus BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has used ransomware variants requiring a key passed on the command line for the malware to execute.(Citation: Cisco B
  • Credential Access TA0006
    • T1003 OS Credential Dumping: [BlackByte](https://attack.mitre.org/groups/G1043) used tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) and [Mimikatz](https://attack.mitre.org/software/S0002) to dump credentials from victim systems.(Citation: Picus BlackByte 2022)(Citation: Microsoft BlackByte 2023)
  • Discovery TA0007
    • T1012 Query Registry: [BlackByte](https://attack.mitre.org/groups/G1043) queried registry values to determine system language settings.(Citation: Picus BlackByte 2022)
    • T1016 System Network Configuration Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) used tools such as [Arp](https://attack.mitre.org/software/S0099) to pull system network information and identify connected devices.(Citation: FBI BlackByte 2022)(Citation: Microsoft BlackByte 2023)
    • T1018 Remote System Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) used tools such as [Arp](https://attack.mitre.org/software/S0099) to identify remotely-connected devices.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)
    • T1046 Network Service Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) has used tools such as NetScan to enumerate network services in victim environments.(Citation: Microsoft BlackByte 2023)
    • T1082 System Information Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) used various system commands and tools to pull system information during operations.(Citation: FBI BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)
    • T1087.002 Account Discovery: Domain Account: [BlackByte](https://attack.mitre.org/groups/G1043) has used tools such as [AdFind](https://attack.mitre.org/software/S0552) to identify and enumerate domain accounts.(Citation: Microsoft BlackByte 2023)
    • T1135 Network Share Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) enumerated network shares on victim devices.(Citation: Cisco BlackByte 2024)
    • T1482 Domain Trust Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) enumerated Active Directory information and trust relationships during operations.(Citation: FBI BlackByte 2022)(Citation: Microsoft BlackByte 2023)
    • T1518.001 Software Discovery: Security Software Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) enumerated installed security products during operations.(Citation: Microsoft BlackByte 2023)
    • T1614.001 System Location Discovery: System Language Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) identified system language settings to determine follow-on execution.(Citation: Picus BlackByte 2022)
  • Lateral Movement TA0008
    • T1021.001 Remote Services: Remote Desktop Protocol: [BlackByte](https://attack.mitre.org/groups/G1043) has used RDP to access other hosts within victim networks.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1021.002 Remote Services: SMB/Windows Admin Shares: [BlackByte](https://attack.mitre.org/groups/G1043) used SMB file shares to distribute payloads throughout victim networks, including BlackByte ransomware variants during wormable operations.(Citation: Picus BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1570 Lateral Tool Transfer: [BlackByte](https://attack.mitre.org/groups/G1043) transfered tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) and the AnyDesk remote access tool during operations using SMB shares.(Citation: Picus BlackByte 2022)
  • Collection TA0009
    • T1560 Archive Collected Data: [BlackByte](https://attack.mitre.org/groups/G1043) compressed data collected from victim environments prior to exfiltration.(Citation: Picus BlackByte 2022)
  • Exfiltration TA0010
    • T1041 Exfiltration Over C2 Channel: [BlackByte](https://attack.mitre.org/groups/G1043) transmitted collected victim host information via HTTP POST to command and control infrastructure.(Citation: Microsoft BlackByte 2023)
    • T1567 Exfiltration Over Web Service: [BlackByte](https://attack.mitre.org/groups/G1043) has used services such as `anonymfiles.com` and `file.io` to exfiltrate victim data.(Citation: Picus BlackByte 2022)
  • Command and Control TA0011
    • T1071.001 Application Layer Protocol: Web Protocols: [BlackByte](https://attack.mitre.org/groups/G1043) collected victim device information then transmitted this via HTTP POST to command and control infrastructure.(Citation: Microsoft BlackByte 2023)
    • T1105 Ingress Tool Transfer: [BlackByte](https://attack.mitre.org/groups/G1043) has transferred tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) to victim environments from file sharing and hosting websites.(Citation: Microsoft BlackByte 2023)
    • T1219 Remote Access Tools: [BlackByte](https://attack.mitre.org/groups/G1043) has used tools such as AnyDesk in victim environments.(Citation: Picus BlackByte 2022)(Citation: Microsoft BlackByte 2023)
  • Impact TA0040
    • T1486 Data Encrypted for Impact: [BlackByte](https://attack.mitre.org/groups/G1043) has encrypted victim files for ransom. Early versions of BlackByte ransomware used a common key for encryption, but later versions use unique keys per victim.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1490 Inhibit System Recovery: [BlackByte](https://attack.mitre.org/groups/G1043) resized and deleted volume shadow copy files to prevent system recovery after encryption.(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)
    • T1491.001 Defacement: Internal Defacement: [BlackByte](https://attack.mitre.org/groups/G1043) left ransom notes in all directories where encryption takes place.(Citation: FBI BlackByte 2022)
  • Resource Development TA0042
    • T1583.003 Acquire Infrastructure: Virtual Private Server: [BlackByte](https://attack.mitre.org/groups/G1043) staged encryption keys on virtual private servers operated by the adversary.(Citation: FBI BlackByte 2022)
    • T1608.001 Stage Capabilities: Upload Malware: [BlackByte](https://attack.mitre.org/groups/G1043) has staged tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) at public file sharing and hosting sites.(Citation: Microsoft BlackByte 2023)
  • Defense Impairment TA0112
    • T1112 Modify Registry: [BlackByte](https://attack.mitre.org/groups/G1043) performed Registry modifications to escalate privileges and disable security tools.(Citation: Picus BlackByte 2022)(Citation: Cisco BlackByte 2024)
    • T1685 Disable or Modify Tools: [BlackByte](https://attack.mitre.org/groups/G1043) disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Cisco BlackByte 2024)
    • T1686 Disable or Modify System Firewall: [BlackByte](https://attack.mitre.org/groups/G1043) modified firewall rules on victim machines to enable remote system discovery.(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)

Source: public group profile, group profile · updated on 12 Nov 2026 · active from 04 Oct 2021 to 30 Jul 2025

Exploited vulnerabilities 3

CVEs this group is known to exploit, with the source and confidence of each next to it. Ordered by confidence and real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK
CVE-2024-37085MEDIUMEPSS 27%KEV MITRE ATT&CK
CVE-2016-6662EPSS 68% MITRE ATT&CK

The group's sites

9 known site(s): 0 online, 9 offline, 0 seized.

TypeStatusChanged onAddress
leak siteofflineseen since 12 Nov 2026•••••••• (hidden)
leak siteofflineseen since 12 Nov 2026•••••••• (hidden)
leak siteofflineseen since 12 Nov 2026•••••••• (hidden)
leak siteofflineseen since 12 Nov 2026•••••••• (hidden)
leak siteofflineseen since 12 Nov 2026•••••••• (hidden)
leak siteofflineseen since 12 Nov 2026•••••••• (hidden)
leak siteofflineseen since 12 Nov 2026•••••••• (hidden)
leak siteofflineseen since 12 Nov 2026•••••••• (hidden)
Filesofflineseen since 12 Nov 2026•••••••• (hidden)
Available on the SOC, MSSP and Enterprise plans

Here, the address of each of the group's sites is closed.

These plans unlock the raw intelligence that stays closed on the site:

  • the addresses of the groups' leak and negotiation sites;
  • the victims' names;
  • the full negotiation chat;
  • each group's YARA rules and full detection package;
  • the criminals' contacts (email, .onion, Tox) unmasked.

They also include webhook, Slack and Discord alerts, the MCP for AI assistants and more API volume. Enterprise is by request.

See the plans

Source: public group profile · checked on 12 Nov 2026

Ransom notes 4

The text the group leaves on attacked machines, from a public ransom-note collection.

BB_Readme.txt · 2 contact(s) masked
██████╗ ██╗ █████╗ ██████╗██╗ ██╗██████╗ ██╗ ██╗████████╗███████╗ ██████╗ ██████╗ 
 ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔══██╗╚██╗ ██╔╝╚══██╔══╝██╔════╝ ╚════██╗ ██╔═████╗
 ██████╔╝██║ ███████║██║ █████╔╝ ██████╔╝ ╚████╔╝ ██║ █████╗ █████╔╝ ██║██╔██║
 ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ██╔══██╗ ╚██╔╝ ██║ ██╔══╝ ██╔═══╝ ████╔╝██║
 ██████╔╝███████╗██║ ██║╚██████╗██║ ██╗██████╔╝ ██║ ██║ ███████╗ ███████╗██╗╚██████╔╝
 ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═════╝ ╚═╝ ╚═╝ ╚══════╝ ╚══════╝╚═╝ ╚═════╝ 

 +-----------------------------------------------------------------------------+
 | All your files have been encrypted, your confidential data has been stolen, |
 | in order to decrypt files and avoid leakage, you must follow our steps. |
 +-----------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------------------------------------------+
 | 1) Download and install TOR Browser from this site: [link] |
 | |
 | 2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need. |
 | |
 | 3) If you read this message thats means your files already for sell in our Auction. |
 | Everyday of delaying will cause higer price. after 4 days if you wont connect us, |
 | We will remove your chat access and you will lose your chance to get decrypted. |
 | |
 +------------------------------------------------------------------------------------------------------------------------------------+

 +---------------------------------------------------------------------------------------------------+
 | Warning! Communication with us occurs only through this link, or through our mail on our Auction. |
 | We also strongly DO NOT recommend using third-party tools to decrypt files, |
 | as this will simply kill them completely without the possibility of recovery. |
 | I repeat, in this case, no one can help you! |
 +---------------------------------------------------------------------------------------------------+


 Your URL: [.onion address]:81/[snip]

 Your Key to access the chat: [snip]

 Find our Auction here (TOR Browser): [.onion address]
BB_Readme2.txt · 1 contact(s) masked
??????? ??? ?????? ?????????? ?????????? ??? ???????????????????? ???? ????????????
 ??????????? ??????????????????? ???????????????? ????????????????????? ????? ????????????
 ??????????? ??????????? ??????? ???????? ??????? ??? ?????? ?????? ??? ??? 
 ??????????? ??????????? ??????? ???????? ????? ??? ?????? ?????????? ??? 
 ??????????????????? ?????????????? ??????????? ??? ??? ???????? ??? ?????? ??? 
 ??????? ??????????? ??? ?????????? ?????????? ??? ??? ???????? ??? ????? ??? 
 

 +-----------------------------------------------------------------------------+
 | All your files have been encrypted, in order to decrypt files, |
 | you must follow our steps. |
 +-----------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------------------------------------------+
 | 1) Download and install TOR Browser from this site: [link] |
 | |
 | 2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need. |
 | |
 | 3) Everyday of delaying will cause higer price. After 4 days if you wont connect us, |
 | We will remove your chat access and you will lose your chance to get decrypted. |
 | |
 +------------------------------------------------------------------------------------------------------------------------------------+

 +---------------------------------------------------------------------------------------------------+
 | We also strongly DO NOT recommend using third-party tools to decrypt files, |
 | as this will simply kill them completely without the possibility of recovery. |
 | I repeat, in this case, no one can help you! |
 +---------------------------------------------------------------------------------------------------+


 Your URL: [.onion address]:81/[snip]

 Your Key to access the chat: [snip]
BB_Readme_[rand].txt · 2 contact(s) masked
██████╗ ██╗ █████╗ ██████╗██╗ ██╗██████╗ ██╗ ██╗████████╗███████╗ ███╗ ██╗████████╗
 ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔══██╗╚██╗ ██╔╝╚══██╔══╝██╔════╝ ████╗ ██║╚══██╔══╝
 ██████╔╝██║ ███████║██║ █████╔╝ ██████╔╝ ╚████╔╝ ██║ █████╗ ██╔██╗ ██║ ██║ 
 ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ██╔══██╗ ╚██╔╝ ██║ ██╔══╝ ██║╚██╗██║ ██║ 
 ██████╔╝███████╗██║ ██║╚██████╗██║ ██╗██████╔╝ ██║ ██║ ███████╗ ██║ ╚████║ ██║ 
 ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═════╝ ╚═╝ ╚═╝ ╚══════╝ ╚═╝ ╚═══╝ ╚═╝ 
 

 +-----------------------------------------------------------------------------+
 | All your files have been encrypted, your confidential data has been stolen, |
 | in order to decrypt files and avoid leakage, you must follow our steps. |
 +-----------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------------------------------------------+
 | 1) Download and install TOR Browser from this site: [link] |
 | |
 | 2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need. |
 | |
 | 3) If you read this message thats means your files already for sell in our Auction. |
 | Everyday of delaying will cause higer price. after 4 days if you wont connect us, |
 | We will remove your chat access and you will lose your chance to get decrypted. |
 | |
 +------------------------------------------------------------------------------------------------------------------------------------+

 +---------------------------------------------------------------------------------------------------+
 | Warning! Communication with us occurs only through this link, or through our mail on our Auction. |
 | We also strongly DO NOT recommend using third-party tools to decrypt files, |
 | as this will simply kill them completely without the possibility of recovery. |
 | I repeat, in this case, no one can help you! |
 +---------------------------------------------------------------------------------------------------+


 Your URL: [.onion address]:81/[snip]

 Your Key to access the chat: [snip]

 Find our Auction here (TOR Browser): [.onion address]
blackbyte_v2.txt · 2 contact(s) masked
██████╗ ██╗ █████╗ ██████╗██╗ ██╗██████╗ ██╗ ██╗████████╗███████╗
 ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔══██╗╚██╗ ██╔╝╚══██╔══╝██╔════╝
 ██████╔╝██║ ███████║██║ █████╔╝ ██████╔╝ ╚████╔╝ ██║ █████╗ 
 ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ██╔══██╗ ╚██╔╝ ██║ ██╔══╝ 
 ██████╔╝███████╗██║ ██║╚██████╗██║ ██╗██████╔╝ ██║ ██║ ███████╗
 ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═════╝ ╚═╝ ╚═╝ ╚══════╝

 +-----------------------------------------------------------------------------+
 | All your files have been encrypted, your confidential data has been stolen, |
 | in order to decrypt files and avoid leakage, you must follow our steps. |
 +-----------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------------------------------------------+
 | 1) Download and install TOR Browser from this site: [link] |
 | |
 | 2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need. |
 | |
 | 3) If you do not contact us within 4 days, your chat access key won't be valid. |
 | Also, your company will be posted on our blog, darknet and hacker forums, |
 | which will attract unnecessary attention from journalists and not only them. |
 | You are given 4 days to think over the situation, and take reasonable actions on your part. |
 +------------------------------------------------------------------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------+
 | Warning! Communication with us occurs only through this link, or through our mail on our blog. |
 | We also strongly DO NOT recommend using third-party tools to decrypt files, |
 | as this will simply kill them completely without the possibility of recovery. |
 | I repeat, in this case, no one can help you! |
 +------------------------------------------------------------------------------------------------+


 Your URL: [.onion address]

 Your Key to access the chat: [snip]

 Find our blog here (TOR Browser): [.onion address]
Available on the SOC, MSSP and Enterprise plans

Here, the criminals' contacts in the notes are masked.

These plans unlock the raw intelligence that stays closed on the site:

  • the addresses of the groups' leak and negotiation sites;
  • the victims' names;
  • the full negotiation chat;
  • each group's YARA rules and full detection package;
  • the criminals' contacts (email, .onion, Tox) unmasked.

They also include webhook, Slack and Discord alerts, the MCP for AI assistants and more API volume. Enterprise is by request.

See the plans

Source: public ransom-note collection · updated on 12 Nov 2026

Detection 1

The package a security team uses to hunt for the group in its own environment: the indicators (IOCs) and the YARA rules, from open intelligence on the group.

YARA rules 1 rule(s)

BlackByte.yar

Available on the SOC, MSSP and Enterprise plans

Here, the YARA rules and the full package download (with every indicator) are closed.

These plans unlock the raw intelligence that stays closed on the site:

  • the addresses of the groups' leak and negotiation sites;
  • the victims' names;
  • the full negotiation chat;
  • each group's YARA rules and full detection package;
  • the criminals' contacts (email, .onion, Tox) unmasked.

They also include webhook, Slack and Discord alerts, the MCP for AI assistants and more API volume. Enterprise is by request.

See the plans

Defensive content: use it only in environments you are authorized to analyze. Source: open intelligence on the group · updated on 12 Nov 2026

Impact and victims

The group BlackByte has 8 known ransomware victims. See the most affected sectors and countries and recent victims.

8known victims
4in Brazil
6sectors hit
Most attacked sectors
Manufacturing2
Technology2
Agriculture and Food Production1
Education1
Government & Defense1
Transportation1
Most affected countries
🇧🇷 Brazil4
🇦🇷 Argentina1
🇨🇱 Chile1
🇲🇽 Mexico1
🇵🇪 Peru1
Recent victims
Name hiddenTechnology · BR · 2025-07-30
Name hiddenTechnology · BR · 2024-09-30
Name hiddenManufacturing · CL · 2023-04-09
Name hiddenTransportation · BR · 2022-12-29
Name hiddenManufacturing · AR · 2022-11-22
Name hiddenAgriculture and Food Production · BR · 2022-11-05
Name hiddenGovernment & Defense · MX · 2022-10-26
Name hiddenEducation · PE · 2022-10-21

Victims' names show on the SOC, MSSP and Enterprise plans. See the plans

BlackByte uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →