RansomwareApunta a BrasilG1043

BlackByte

También conocido como: Hecamede

Seguir este grupo

Aviso por correo de CVE nueva atribuida, víctima nueva en Brasil e incidente verificado.

Sobre el grupo

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.

Cadena de ataque

Escenario plausible montado a partir de las técnicas reales del grupo, ordenadas por las fases de un ataque. Cada etapa muestra cómo suele actuar el grupo.

Severidad del arsenal75
Impacto: Crítico
T1190T1047T1136.002T1068T1560T1041ENTRYAcceso inicialExploitPublic-Facing App…EXECEjecuciónWindows ManagementInstrumentationPERSPersistenciaDomain AccountPRIVEscalada de privilegiosExploitation forPrivilege Escalat…COLLRecolecciónArchive CollectedDataEXFILExfiltraciónExfiltration OverC2 ChannelIMPACTImpactoData Encrypted forImpact

Cadena ilustrativa derivada de las técnicas documentadas en MITRE ATT&CK — no representa un ataque específico ya ocurrido. La severidad resume el arsenal conocido (cobertura de la cadena, CVEs en explotación activa, técnicas).

Técnicas (MITRE ATT&CK) 48

Cómo opera el grupo, mapeado por la matriz MITRE ATT&CK y organizado por las fases de un ataque.

Preparación de recursos
Virtual Private ServerUpload Malware
Acceso inicial
Exploit Public-Facing Application
Ejecución
Windows Management InstrumentationScheduled TaskPowerShellWindows Command ShellService Execution
Persistencia
Domain AccountWeb ShellWindows ServiceRegistry Run Keys / Startup Folder
Escalada de privilegios
Exploitation for Privilege Escalation
Acceso a credenciales
OS Credential Dumping
Descubrimiento
Query RegistrySystem Network Configuration DiscoveryRemote System DiscoveryNetwork Service DiscoverySystem Information DiscoveryDomain AccountNetwork Share DiscoveryDomain Trust DiscoverySecurity Software DiscoverySystem Language Discovery
Movimiento lateral
Remote Desktop ProtocolSMB/Windows Admin SharesLateral Tool Transfer
Recolección
Archive Collected Data
Comando y control
Web ProtocolsIngress Tool TransferRemote Access Tools
Exfiltración
Exfiltration Over C2 ChannelExfiltration Over Web Service
Impacto
Data Encrypted for ImpactInhibit System RecoveryInternal Defacement
defense-impairment
Modify RegistryDisable or Modify ToolsDisable or Modify System Firewall
stealth
Masquerade File TypeProcess InjectionProcess HollowingFile DeletionValid AccountsDomain AccountsMake and Impersonate TokenDeobfuscate/Decode Files or InformationExecution Guardrails

Arsenal y tácticas

Lo que el grupo usa y cómo ataca, según el perfil público del grupo, compilado a partir de informes públicos. Las CVE de ese perfil están en la sección de CVE, con la fuente al lado.

Herramientas

Herramientas ofensivas
Cobalt StrikePowerShell Empire
Descubrimiento y mapeo de la red
PowerViewSoftPerfect NetScan
Evasión de defensas
Dell Client driver (BYOVD)GIGABYTE Motherboard driver (BYOVD)MSI Afterburner driver (BYOVD)Zemana Anti-Rootkit driver
Acceso remoto (RMM)
AnyDesk

Cómo ataca el grupo

El detalle de cada técnica es el texto de la fuente, en inglés.

  • Initial Access TA0001
    • T1078 Valid Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) has gained access to victim environments through legitimate VPN credentials.(Citation: Cisco BlackByte 2024)
    • T1078.002 Valid Accounts: Domain Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) captured credentials for or impersonated domain administration users.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1190 Exploit Public-Facing Application: [BlackByte](https://attack.mitre.org/groups/G1043) exploited vulnerabilities such as ProxyLogon and ProxyShell for initial access to victim environments.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)
  • Execution TA0002
    • T1047 Windows Management Instrumentation: [BlackByte](https://attack.mitre.org/groups/G1043) used WMI to delete Volume Shadow Copies on victim machines.(Citation: FBI BlackByte 2022)
    • T1053.005 Scheduled Task/Job: Scheduled Task: [BlackByte](https://attack.mitre.org/groups/G1043) created scheduled tasks for payload execution.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)
    • T1059.001 Command and Scripting Interpreter: PowerShell: [BlackByte](https://attack.mitre.org/groups/G1043) used encoded PowerShell commands during operations.(Citation: FBI BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has used remote PowerShell commands in victim networks.(Citation: Microsoft BlackByte 2023)
    • T1059.003 Command and Scripting Interpreter: Windows Command Shell: [BlackByte](https://attack.mitre.org/groups/G1043) executed ransomware using the Windows command shell.(Citation: FBI BlackByte 2022)
    • T1569.002 System Services: Service Execution: [BlackByte](https://attack.mitre.org/groups/G1043) created malicious services for ransomware execution.(Citation: Symantec BlackByte 2022)(Citation: Cisco BlackByte 2024)
  • Persistence TA0003
    • T1053.005 Scheduled Task/Job: Scheduled Task: [BlackByte](https://attack.mitre.org/groups/G1043) created scheduled tasks for payload execution.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)
    • T1078 Valid Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) has gained access to victim environments through legitimate VPN credentials.(Citation: Cisco BlackByte 2024)
    • T1078.002 Valid Accounts: Domain Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) captured credentials for or impersonated domain administration users.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1112 Modify Registry: [BlackByte](https://attack.mitre.org/groups/G1043) performed Registry modifications to escalate privileges and disable security tools.(Citation: Picus BlackByte 2022)(Citation: Cisco BlackByte 2024)
    • T1136.002 Create Account: Domain Account: [BlackByte](https://attack.mitre.org/groups/G1043) created privileged domain accounts during intrusions.(Citation: Cisco BlackByte 2024)
    • T1505.003 Server Software Component: Web Shell: [BlackByte](https://attack.mitre.org/groups/G1043) has used ASPX web shells following exploitation of vulnerabilities in services such as Microsoft Exchange.(Citation: Picus BlackByte 2022)(Citation: Microsoft BlackByte 2023)
    • T1543.003 Create or Modify System Process: Windows Service: [BlackByte](https://attack.mitre.org/groups/G1043) modified multiple services on victim machines to enable encryption operations.(Citation: Symantec BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has installed tools such as AnyDesk as a service on victim machines.(Citation: Microsoft BlackByte 2023)
    • T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder: [BlackByte](https://attack.mitre.org/groups/G1043) has used Registry Run keys for persistence.(Citation: Microsoft BlackByte 2023)
  • Privilege Escalation TA0004
    • T1053.005 Scheduled Task/Job: Scheduled Task: [BlackByte](https://attack.mitre.org/groups/G1043) created scheduled tasks for payload execution.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)
    • T1055 Process Injection: [BlackByte](https://attack.mitre.org/groups/G1043) has injected [Cobalt Strike](https://attack.mitre.org/software/S0154) into `wuauclt.exe` during intrusions.(Citation: Picus BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has injected ransomware into `svchost.exe` before encryption.(Citation: Symantec BlackByte 2022)
    • T1055.012 Process Injection: Process Hollowing: [BlackByte](https://attack.mitre.org/groups/G1043) used process hollowing for defense evasion purposes.(Citation: Microsoft BlackByte 2023)
    • T1068 Exploitation for Privilege Escalation: [BlackByte](https://attack.mitre.org/groups/G1043) has exploited CVE-2024-37085 in VMWare ESXi software for authentication bypass and subsequent privilege escalation.(Citation: Cisco BlackByte 2024)
    • T1078 Valid Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) has gained access to victim environments through legitimate VPN credentials.(Citation: Cisco BlackByte 2024)
    • T1078.002 Valid Accounts: Domain Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) captured credentials for or impersonated domain administration users.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1134.003 Access Token Manipulation: Make and Impersonate Token: [BlackByte](https://attack.mitre.org/groups/G1043) constructed a valid authentication token following Microsoft Exchange exploitation to allow for follow-on privileged command execution.(Citation: Microsoft BlackByte 2023)
    • T1543.003 Create or Modify System Process: Windows Service: [BlackByte](https://attack.mitre.org/groups/G1043) modified multiple services on victim machines to enable encryption operations.(Citation: Symantec BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has installed tools such as AnyDesk as a service on victim machines.(Citation: Microsoft BlackByte 2023)
    • T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder: [BlackByte](https://attack.mitre.org/groups/G1043) has used Registry Run keys for persistence.(Citation: Microsoft BlackByte 2023)
  • Stealth TA0005
    • T1036.008 Masquerading: Masquerade File Type: [BlackByte](https://attack.mitre.org/groups/G1043) masqueraded configuration files containing encryption keys as PNG files.(Citation: FBI BlackByte 2022)
    • T1055 Process Injection: [BlackByte](https://attack.mitre.org/groups/G1043) has injected [Cobalt Strike](https://attack.mitre.org/software/S0154) into `wuauclt.exe` during intrusions.(Citation: Picus BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has injected ransomware into `svchost.exe` before encryption.(Citation: Symantec BlackByte 2022)
    • T1055.012 Process Injection: Process Hollowing: [BlackByte](https://attack.mitre.org/groups/G1043) used process hollowing for defense evasion purposes.(Citation: Microsoft BlackByte 2023)
    • T1070.004 Indicator Removal: File Deletion: [BlackByte](https://attack.mitre.org/groups/G1043) deleted ransomware executables post-encryption.(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1078 Valid Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) has gained access to victim environments through legitimate VPN credentials.(Citation: Cisco BlackByte 2024)
    • T1078.002 Valid Accounts: Domain Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) captured credentials for or impersonated domain administration users.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1134.003 Access Token Manipulation: Make and Impersonate Token: [BlackByte](https://attack.mitre.org/groups/G1043) constructed a valid authentication token following Microsoft Exchange exploitation to allow for follow-on privileged command execution.(Citation: Microsoft BlackByte 2023)
    • T1140 Deobfuscate/Decode Files or Information: [BlackByte](https://attack.mitre.org/groups/G1043) has encoded commands in base64-encoded sections concatenated together in PowerShell.(Citation: FBI BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) uses PowerShell commands to disable Windows Defender.(Citation: Picus BlackByte 2022)
    • T1480 Execution Guardrails: [BlackByte](https://attack.mitre.org/groups/G1043) stopped execution if identified language settings on victim machines was Russian or one of several language associated with former Soviet republics.(Citation: Picus BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has used ransomware variants requiring a key passed on the command line for the malware to execute.(Citation: Cisco B
  • Credential Access TA0006
    • T1003 OS Credential Dumping: [BlackByte](https://attack.mitre.org/groups/G1043) used tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) and [Mimikatz](https://attack.mitre.org/software/S0002) to dump credentials from victim systems.(Citation: Picus BlackByte 2022)(Citation: Microsoft BlackByte 2023)
  • Discovery TA0007
    • T1012 Query Registry: [BlackByte](https://attack.mitre.org/groups/G1043) queried registry values to determine system language settings.(Citation: Picus BlackByte 2022)
    • T1016 System Network Configuration Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) used tools such as [Arp](https://attack.mitre.org/software/S0099) to pull system network information and identify connected devices.(Citation: FBI BlackByte 2022)(Citation: Microsoft BlackByte 2023)
    • T1018 Remote System Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) used tools such as [Arp](https://attack.mitre.org/software/S0099) to identify remotely-connected devices.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)
    • T1046 Network Service Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) has used tools such as NetScan to enumerate network services in victim environments.(Citation: Microsoft BlackByte 2023)
    • T1082 System Information Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) used various system commands and tools to pull system information during operations.(Citation: FBI BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)
    • T1087.002 Account Discovery: Domain Account: [BlackByte](https://attack.mitre.org/groups/G1043) has used tools such as [AdFind](https://attack.mitre.org/software/S0552) to identify and enumerate domain accounts.(Citation: Microsoft BlackByte 2023)
    • T1135 Network Share Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) enumerated network shares on victim devices.(Citation: Cisco BlackByte 2024)
    • T1482 Domain Trust Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) enumerated Active Directory information and trust relationships during operations.(Citation: FBI BlackByte 2022)(Citation: Microsoft BlackByte 2023)
    • T1518.001 Software Discovery: Security Software Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) enumerated installed security products during operations.(Citation: Microsoft BlackByte 2023)
    • T1614.001 System Location Discovery: System Language Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) identified system language settings to determine follow-on execution.(Citation: Picus BlackByte 2022)
  • Lateral Movement TA0008
    • T1021.001 Remote Services: Remote Desktop Protocol: [BlackByte](https://attack.mitre.org/groups/G1043) has used RDP to access other hosts within victim networks.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1021.002 Remote Services: SMB/Windows Admin Shares: [BlackByte](https://attack.mitre.org/groups/G1043) used SMB file shares to distribute payloads throughout victim networks, including BlackByte ransomware variants during wormable operations.(Citation: Picus BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1570 Lateral Tool Transfer: [BlackByte](https://attack.mitre.org/groups/G1043) transfered tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) and the AnyDesk remote access tool during operations using SMB shares.(Citation: Picus BlackByte 2022)
  • Collection TA0009
    • T1560 Archive Collected Data: [BlackByte](https://attack.mitre.org/groups/G1043) compressed data collected from victim environments prior to exfiltration.(Citation: Picus BlackByte 2022)
  • Exfiltration TA0010
    • T1041 Exfiltration Over C2 Channel: [BlackByte](https://attack.mitre.org/groups/G1043) transmitted collected victim host information via HTTP POST to command and control infrastructure.(Citation: Microsoft BlackByte 2023)
    • T1567 Exfiltration Over Web Service: [BlackByte](https://attack.mitre.org/groups/G1043) has used services such as `anonymfiles.com` and `file.io` to exfiltrate victim data.(Citation: Picus BlackByte 2022)
  • Command and Control TA0011
    • T1071.001 Application Layer Protocol: Web Protocols: [BlackByte](https://attack.mitre.org/groups/G1043) collected victim device information then transmitted this via HTTP POST to command and control infrastructure.(Citation: Microsoft BlackByte 2023)
    • T1105 Ingress Tool Transfer: [BlackByte](https://attack.mitre.org/groups/G1043) has transferred tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) to victim environments from file sharing and hosting websites.(Citation: Microsoft BlackByte 2023)
    • T1219 Remote Access Tools: [BlackByte](https://attack.mitre.org/groups/G1043) has used tools such as AnyDesk in victim environments.(Citation: Picus BlackByte 2022)(Citation: Microsoft BlackByte 2023)
  • Impact TA0040
    • T1486 Data Encrypted for Impact: [BlackByte](https://attack.mitre.org/groups/G1043) has encrypted victim files for ransom. Early versions of BlackByte ransomware used a common key for encryption, but later versions use unique keys per victim.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1490 Inhibit System Recovery: [BlackByte](https://attack.mitre.org/groups/G1043) resized and deleted volume shadow copy files to prevent system recovery after encryption.(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)
    • T1491.001 Defacement: Internal Defacement: [BlackByte](https://attack.mitre.org/groups/G1043) left ransom notes in all directories where encryption takes place.(Citation: FBI BlackByte 2022)
  • Resource Development TA0042
    • T1583.003 Acquire Infrastructure: Virtual Private Server: [BlackByte](https://attack.mitre.org/groups/G1043) staged encryption keys on virtual private servers operated by the adversary.(Citation: FBI BlackByte 2022)
    • T1608.001 Stage Capabilities: Upload Malware: [BlackByte](https://attack.mitre.org/groups/G1043) has staged tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) at public file sharing and hosting sites.(Citation: Microsoft BlackByte 2023)
  • Defense Impairment TA0112
    • T1112 Modify Registry: [BlackByte](https://attack.mitre.org/groups/G1043) performed Registry modifications to escalate privileges and disable security tools.(Citation: Picus BlackByte 2022)(Citation: Cisco BlackByte 2024)
    • T1685 Disable or Modify Tools: [BlackByte](https://attack.mitre.org/groups/G1043) disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Cisco BlackByte 2024)
    • T1686 Disable or Modify System Firewall: [BlackByte](https://attack.mitre.org/groups/G1043) modified firewall rules on victim machines to enable remote system discovery.(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)

Fuente: perfil público del grupo, perfil del grupo · actualizado el 12 nov 2026 · actividad de 04 oct 2021 a 30 jul 2025

Vulnerabilidades explotadas 3

CVE que este grupo es conocido por explotar, con la fuente y la confianza de cada una al lado. Ordenadas por la confianza y la gravedad real.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK
CVE-2024-37085MEDIUMEPSS 27%KEV MITRE ATT&CK
CVE-2016-6662EPSS 68% MITRE ATT&CK

Sitios del grupo

9 sitio(s) conocido(s): 0 en línea, 9 fuera de línea, 0 incautado(s).

TipoEstadoCambió elDirección
filtraciónfuera de líneavisto desde 12 nov 2026•••••••• (oculto)
filtraciónfuera de líneavisto desde 12 nov 2026•••••••• (oculto)
filtraciónfuera de líneavisto desde 12 nov 2026•••••••• (oculto)
filtraciónfuera de líneavisto desde 12 nov 2026•••••••• (oculto)
filtraciónfuera de líneavisto desde 12 nov 2026•••••••• (oculto)
filtraciónfuera de líneavisto desde 12 nov 2026•••••••• (oculto)
filtraciónfuera de líneavisto desde 12 nov 2026•••••••• (oculto)
filtraciónfuera de líneavisto desde 12 nov 2026•••••••• (oculto)
Filesfuera de líneavisto desde 12 nov 2026•••••••• (oculto)
Disponible en los planes SOC, MSSP y Enterprise

Aquí, la dirección de cada sitio del grupo queda cerrada.

Estos planes abren el contenido bruto de inteligencia que queda cerrado en el sitio:

  • las direcciones de los sitios de filtración y de negociación de los grupos;
  • el nombre de las víctimas;
  • el chat de negociación completo;
  • las reglas YARA y el paquete de detección completo de cada grupo;
  • los contactos de los criminales (correo, .onion, Tox) sin máscara.

También incluyen las alertas por webhook, Slack y Discord, el MCP para asistentes de IA y más volumen en la API. Enterprise es bajo consulta.

Ver los planes

Fuente: perfil público del grupo · verificado el 12 nov 2026

Notas de rescate 4

El texto que el grupo deja en las máquinas atacadas, de un acervo público de notas de rescate.

BB_Readme.txt · 2 contacto(s) enmascarado(s)
██████╗ ██╗ █████╗ ██████╗██╗ ██╗██████╗ ██╗ ██╗████████╗███████╗ ██████╗ ██████╗ 
 ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔══██╗╚██╗ ██╔╝╚══██╔══╝██╔════╝ ╚════██╗ ██╔═████╗
 ██████╔╝██║ ███████║██║ █████╔╝ ██████╔╝ ╚████╔╝ ██║ █████╗ █████╔╝ ██║██╔██║
 ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ██╔══██╗ ╚██╔╝ ██║ ██╔══╝ ██╔═══╝ ████╔╝██║
 ██████╔╝███████╗██║ ██║╚██████╗██║ ██╗██████╔╝ ██║ ██║ ███████╗ ███████╗██╗╚██████╔╝
 ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═════╝ ╚═╝ ╚═╝ ╚══════╝ ╚══════╝╚═╝ ╚═════╝ 

 +-----------------------------------------------------------------------------+
 | All your files have been encrypted, your confidential data has been stolen, |
 | in order to decrypt files and avoid leakage, you must follow our steps. |
 +-----------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------------------------------------------+
 | 1) Download and install TOR Browser from this site: [enlace] |
 | |
 | 2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need. |
 | |
 | 3) If you read this message thats means your files already for sell in our Auction. |
 | Everyday of delaying will cause higer price. after 4 days if you wont connect us, |
 | We will remove your chat access and you will lose your chance to get decrypted. |
 | |
 +------------------------------------------------------------------------------------------------------------------------------------+

 +---------------------------------------------------------------------------------------------------+
 | Warning! Communication with us occurs only through this link, or through our mail on our Auction. |
 | We also strongly DO NOT recommend using third-party tools to decrypt files, |
 | as this will simply kill them completely without the possibility of recovery. |
 | I repeat, in this case, no one can help you! |
 +---------------------------------------------------------------------------------------------------+


 Your URL: [dirección .onion]:81/[snip]

 Your Key to access the chat: [snip]

 Find our Auction here (TOR Browser): [dirección .onion]
BB_Readme2.txt · 1 contacto(s) enmascarado(s)
??????? ??? ?????? ?????????? ?????????? ??? ???????????????????? ???? ????????????
 ??????????? ??????????????????? ???????????????? ????????????????????? ????? ????????????
 ??????????? ??????????? ??????? ???????? ??????? ??? ?????? ?????? ??? ??? 
 ??????????? ??????????? ??????? ???????? ????? ??? ?????? ?????????? ??? 
 ??????????????????? ?????????????? ??????????? ??? ??? ???????? ??? ?????? ??? 
 ??????? ??????????? ??? ?????????? ?????????? ??? ??? ???????? ??? ????? ??? 
 

 +-----------------------------------------------------------------------------+
 | All your files have been encrypted, in order to decrypt files, |
 | you must follow our steps. |
 +-----------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------------------------------------------+
 | 1) Download and install TOR Browser from this site: [enlace] |
 | |
 | 2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need. |
 | |
 | 3) Everyday of delaying will cause higer price. After 4 days if you wont connect us, |
 | We will remove your chat access and you will lose your chance to get decrypted. |
 | |
 +------------------------------------------------------------------------------------------------------------------------------------+

 +---------------------------------------------------------------------------------------------------+
 | We also strongly DO NOT recommend using third-party tools to decrypt files, |
 | as this will simply kill them completely without the possibility of recovery. |
 | I repeat, in this case, no one can help you! |
 +---------------------------------------------------------------------------------------------------+


 Your URL: [dirección .onion]:81/[snip]

 Your Key to access the chat: [snip]
BB_Readme_[rand].txt · 2 contacto(s) enmascarado(s)
██████╗ ██╗ █████╗ ██████╗██╗ ██╗██████╗ ██╗ ██╗████████╗███████╗ ███╗ ██╗████████╗
 ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔══██╗╚██╗ ██╔╝╚══██╔══╝██╔════╝ ████╗ ██║╚══██╔══╝
 ██████╔╝██║ ███████║██║ █████╔╝ ██████╔╝ ╚████╔╝ ██║ █████╗ ██╔██╗ ██║ ██║ 
 ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ██╔══██╗ ╚██╔╝ ██║ ██╔══╝ ██║╚██╗██║ ██║ 
 ██████╔╝███████╗██║ ██║╚██████╗██║ ██╗██████╔╝ ██║ ██║ ███████╗ ██║ ╚████║ ██║ 
 ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═════╝ ╚═╝ ╚═╝ ╚══════╝ ╚═╝ ╚═══╝ ╚═╝ 
 

 +-----------------------------------------------------------------------------+
 | All your files have been encrypted, your confidential data has been stolen, |
 | in order to decrypt files and avoid leakage, you must follow our steps. |
 +-----------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------------------------------------------+
 | 1) Download and install TOR Browser from this site: [enlace] |
 | |
 | 2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need. |
 | |
 | 3) If you read this message thats means your files already for sell in our Auction. |
 | Everyday of delaying will cause higer price. after 4 days if you wont connect us, |
 | We will remove your chat access and you will lose your chance to get decrypted. |
 | |
 +------------------------------------------------------------------------------------------------------------------------------------+

 +---------------------------------------------------------------------------------------------------+
 | Warning! Communication with us occurs only through this link, or through our mail on our Auction. |
 | We also strongly DO NOT recommend using third-party tools to decrypt files, |
 | as this will simply kill them completely without the possibility of recovery. |
 | I repeat, in this case, no one can help you! |
 +---------------------------------------------------------------------------------------------------+


 Your URL: [dirección .onion]:81/[snip]

 Your Key to access the chat: [snip]

 Find our Auction here (TOR Browser): [dirección .onion]
blackbyte_v2.txt · 2 contacto(s) enmascarado(s)
██████╗ ██╗ █████╗ ██████╗██╗ ██╗██████╗ ██╗ ██╗████████╗███████╗
 ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔══██╗╚██╗ ██╔╝╚══██╔══╝██╔════╝
 ██████╔╝██║ ███████║██║ █████╔╝ ██████╔╝ ╚████╔╝ ██║ █████╗ 
 ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ██╔══██╗ ╚██╔╝ ██║ ██╔══╝ 
 ██████╔╝███████╗██║ ██║╚██████╗██║ ██╗██████╔╝ ██║ ██║ ███████╗
 ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═════╝ ╚═╝ ╚═╝ ╚══════╝

 +-----------------------------------------------------------------------------+
 | All your files have been encrypted, your confidential data has been stolen, |
 | in order to decrypt files and avoid leakage, you must follow our steps. |
 +-----------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------------------------------------------+
 | 1) Download and install TOR Browser from this site: [enlace] |
 | |
 | 2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need. |
 | |
 | 3) If you do not contact us within 4 days, your chat access key won't be valid. |
 | Also, your company will be posted on our blog, darknet and hacker forums, |
 | which will attract unnecessary attention from journalists and not only them. |
 | You are given 4 days to think over the situation, and take reasonable actions on your part. |
 +------------------------------------------------------------------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------+
 | Warning! Communication with us occurs only through this link, or through our mail on our blog. |
 | We also strongly DO NOT recommend using third-party tools to decrypt files, |
 | as this will simply kill them completely without the possibility of recovery. |
 | I repeat, in this case, no one can help you! |
 +------------------------------------------------------------------------------------------------+


 Your URL: [dirección .onion]

 Your Key to access the chat: [snip]

 Find our blog here (TOR Browser): [dirección .onion]
Disponible en los planes SOC, MSSP y Enterprise

Aquí, los contactos de los criminales en las notas quedan enmascarados.

Estos planes abren el contenido bruto de inteligencia que queda cerrado en el sitio:

  • las direcciones de los sitios de filtración y de negociación de los grupos;
  • el nombre de las víctimas;
  • el chat de negociación completo;
  • las reglas YARA y el paquete de detección completo de cada grupo;
  • los contactos de los criminales (correo, .onion, Tox) sin máscara.

También incluyen las alertas por webhook, Slack y Discord, el MCP para asistentes de IA y más volumen en la API. Enterprise es bajo consulta.

Ver los planes

Fuente: acervo público de notas de rescate · actualizado el 12 nov 2026

Detección 1

El paquete que el equipo de seguridad usa para buscar al grupo en su propio entorno: los indicadores (IOC) y las reglas YARA, de inteligencia abierta sobre el grupo.

Reglas YARA 1 regla(s)

BlackByte.yar

Disponible en los planes SOC, MSSP y Enterprise

Aquí, las reglas YARA y la descarga del paquete completo (con todos los indicadores) quedan cerradas.

Estos planes abren el contenido bruto de inteligencia que queda cerrado en el sitio:

  • las direcciones de los sitios de filtración y de negociación de los grupos;
  • el nombre de las víctimas;
  • el chat de negociación completo;
  • las reglas YARA y el paquete de detección completo de cada grupo;
  • los contactos de los criminales (correo, .onion, Tox) sin máscara.

También incluyen las alertas por webhook, Slack y Discord, el MCP para asistentes de IA y más volumen en la API. Enterprise es bajo consulta.

Ver los planes

Contenido de defensa: úsalo solo en entornos que tienes autorización para analizar. Fuente: inteligencia abierta sobre el grupo · actualizado el 12 nov 2026

Impacto y víctimas

El grupo BlackByte tiene 8 víctimas de ransomware conocidas. Ve los sectores y países más afectados y las víctimas recientes.

8víctimas conocidas
4en Brasil
6sectores afectados
Sectores más atacados
Industria2
Tecnología2
Agricultura y alimentos1
Educación1
Gobierno y defensa1
Transporte1
Países más afectados
🇧🇷 Brasil4
🇦🇷 Argentina1
🇨🇱 Chile1
🇲🇽 México1
🇵🇪 Perú1
Víctimas recientes
Nombre ocultoTecnología · BR · 2025-07-30
Nombre ocultoTecnología · BR · 2024-09-30
Nombre ocultoIndustria · CL · 2023-04-09
Nombre ocultoTransporte · BR · 2022-12-29
Nombre ocultoIndustria · AR · 2022-11-22
Nombre ocultoAgricultura y alimentos · BR · 2022-11-05
Nombre ocultoGobierno y defensa · MX · 2022-10-26
Nombre ocultoEducación · PE · 2022-10-21

Los nombres de las víctimas aparecen en los planes SOC, MSSP y Enterprise. Ver los planes

El grupo BlackByte usa técnicas y explota fallas reales. El Pentest Autónomo con IA de TrueHacking simula esos ataques en tu infraestructura y aporta más seguridad a tu aplicación.

Conocer el Pentest Autónomo con IA →