RansomwareMira o BrasilG1043

BlackByte

Também conhecido como: Hecamede

Seguir este grupo

Aviso por e-mail de CVE nova atribuída, vítima nova no Brasil e incidente verificado.

Análise Vexday

BlackByte (também identificado como Hecamede, G1043 no MITRE ATT&CK) é um agente de ameaça de ransomware ativo desde pelo menos 2021, associado a múltiplas versões do malware homônimo. As versões iniciais do ransomware utilizavam uma chave de criptografia comum, o que permitiu o desenvolvimento de um decryptor universal; versões posteriores, como o BlackByte 2.0, adotaram mecanismos de criptografia mais robustos. O grupo é notável por operações direcionadas a entidades de infraestrutura crítica, entre outros alvos na América do Norte, e possui 48 técnicas documentadas no MITRE ATT&CK, 3 CVEs atribuídas e 4 vítimas conhecidas no Brasil.

Cadeia de ataque

Cenário plausível montado a partir das técnicas reais do grupo, ordenadas pelas fases de um ataque. Cada etapa mostra como o grupo costuma agir.

Severidade do arsenal75
Impacto: Crítico
T1190T1047T1136.002T1068T1560T1041ENTRYAcesso inicialExploitPublic-Facing App…EXECExecuçãoWindows ManagementInstrumentationPERSPersistênciaDomain AccountPRIVEscalada de privilégioExploitation forPrivilege Escalat…COLLColetaArchive CollectedDataEXFILExfiltraçãoExfiltration OverC2 ChannelIMPACTImpactoData Encrypted forImpact

Cadeia ilustrativa derivada das técnicas documentadas no MITRE ATT&CK — não representa um ataque específico já ocorrido. A severidade resume o arsenal conhecido (cobertura da cadeia, CVEs em exploração ativa, técnicas).

Técnicas (MITRE ATT&CK) 48

Como o grupo opera, mapeado pela matriz MITRE ATT&CK e organizado pelas fases de um ataque.

Preparação de recursos
Virtual Private ServerUpload Malware
Acesso inicial
Exploit Public-Facing Application
Execução
Windows Management InstrumentationScheduled TaskPowerShellWindows Command ShellService Execution
Persistência
Domain AccountWeb ShellWindows ServiceRegistry Run Keys / Startup Folder
Escalada de privilégio
Exploitation for Privilege Escalation
Acesso a credenciais
OS Credential Dumping
Descoberta
Query RegistrySystem Network Configuration DiscoveryRemote System DiscoveryNetwork Service DiscoverySystem Information DiscoveryDomain AccountNetwork Share DiscoveryDomain Trust DiscoverySecurity Software DiscoverySystem Language Discovery
Movimento lateral
Remote Desktop ProtocolSMB/Windows Admin SharesLateral Tool Transfer
Coleta
Archive Collected Data
Comando e controle
Web ProtocolsIngress Tool TransferRemote Access Tools
Exfiltração
Exfiltration Over C2 ChannelExfiltration Over Web Service
Impacto
Data Encrypted for ImpactInhibit System RecoveryInternal Defacement
defense-impairment
Modify RegistryDisable or Modify ToolsDisable or Modify System Firewall
stealth
Masquerade File TypeProcess InjectionProcess HollowingFile DeletionValid AccountsDomain AccountsMake and Impersonate TokenDeobfuscate/Decode Files or InformationExecution Guardrails

Arsenal e táticas

O que o grupo usa e como ataca, pelo perfil público do grupo, compilado a partir de relatórios públicos. As CVEs desse perfil estão na seção de CVEs, com a fonte ao lado.

Ferramentas

Ferramentas ofensivas
Cobalt StrikePowerShell Empire
Descoberta e mapeamento da rede
PowerViewSoftPerfect NetScan
Evasão de defesas
Dell Client driver (BYOVD)GIGABYTE Motherboard driver (BYOVD)MSI Afterburner driver (BYOVD)Zemana Anti-Rootkit driver
Acesso remoto (RMM)
AnyDesk

Como o grupo ataca

O detalhe de cada técnica é o texto da fonte, em inglês.

  • Initial Access TA0001
    • T1078 Valid Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) has gained access to victim environments through legitimate VPN credentials.(Citation: Cisco BlackByte 2024)
    • T1078.002 Valid Accounts: Domain Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) captured credentials for or impersonated domain administration users.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1190 Exploit Public-Facing Application: [BlackByte](https://attack.mitre.org/groups/G1043) exploited vulnerabilities such as ProxyLogon and ProxyShell for initial access to victim environments.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)
  • Execution TA0002
    • T1047 Windows Management Instrumentation: [BlackByte](https://attack.mitre.org/groups/G1043) used WMI to delete Volume Shadow Copies on victim machines.(Citation: FBI BlackByte 2022)
    • T1053.005 Scheduled Task/Job: Scheduled Task: [BlackByte](https://attack.mitre.org/groups/G1043) created scheduled tasks for payload execution.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)
    • T1059.001 Command and Scripting Interpreter: PowerShell: [BlackByte](https://attack.mitre.org/groups/G1043) used encoded PowerShell commands during operations.(Citation: FBI BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has used remote PowerShell commands in victim networks.(Citation: Microsoft BlackByte 2023)
    • T1059.003 Command and Scripting Interpreter: Windows Command Shell: [BlackByte](https://attack.mitre.org/groups/G1043) executed ransomware using the Windows command shell.(Citation: FBI BlackByte 2022)
    • T1569.002 System Services: Service Execution: [BlackByte](https://attack.mitre.org/groups/G1043) created malicious services for ransomware execution.(Citation: Symantec BlackByte 2022)(Citation: Cisco BlackByte 2024)
  • Persistence TA0003
    • T1053.005 Scheduled Task/Job: Scheduled Task: [BlackByte](https://attack.mitre.org/groups/G1043) created scheduled tasks for payload execution.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)
    • T1078 Valid Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) has gained access to victim environments through legitimate VPN credentials.(Citation: Cisco BlackByte 2024)
    • T1078.002 Valid Accounts: Domain Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) captured credentials for or impersonated domain administration users.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1112 Modify Registry: [BlackByte](https://attack.mitre.org/groups/G1043) performed Registry modifications to escalate privileges and disable security tools.(Citation: Picus BlackByte 2022)(Citation: Cisco BlackByte 2024)
    • T1136.002 Create Account: Domain Account: [BlackByte](https://attack.mitre.org/groups/G1043) created privileged domain accounts during intrusions.(Citation: Cisco BlackByte 2024)
    • T1505.003 Server Software Component: Web Shell: [BlackByte](https://attack.mitre.org/groups/G1043) has used ASPX web shells following exploitation of vulnerabilities in services such as Microsoft Exchange.(Citation: Picus BlackByte 2022)(Citation: Microsoft BlackByte 2023)
    • T1543.003 Create or Modify System Process: Windows Service: [BlackByte](https://attack.mitre.org/groups/G1043) modified multiple services on victim machines to enable encryption operations.(Citation: Symantec BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has installed tools such as AnyDesk as a service on victim machines.(Citation: Microsoft BlackByte 2023)
    • T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder: [BlackByte](https://attack.mitre.org/groups/G1043) has used Registry Run keys for persistence.(Citation: Microsoft BlackByte 2023)
  • Privilege Escalation TA0004
    • T1053.005 Scheduled Task/Job: Scheduled Task: [BlackByte](https://attack.mitre.org/groups/G1043) created scheduled tasks for payload execution.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)
    • T1055 Process Injection: [BlackByte](https://attack.mitre.org/groups/G1043) has injected [Cobalt Strike](https://attack.mitre.org/software/S0154) into `wuauclt.exe` during intrusions.(Citation: Picus BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has injected ransomware into `svchost.exe` before encryption.(Citation: Symantec BlackByte 2022)
    • T1055.012 Process Injection: Process Hollowing: [BlackByte](https://attack.mitre.org/groups/G1043) used process hollowing for defense evasion purposes.(Citation: Microsoft BlackByte 2023)
    • T1068 Exploitation for Privilege Escalation: [BlackByte](https://attack.mitre.org/groups/G1043) has exploited CVE-2024-37085 in VMWare ESXi software for authentication bypass and subsequent privilege escalation.(Citation: Cisco BlackByte 2024)
    • T1078 Valid Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) has gained access to victim environments through legitimate VPN credentials.(Citation: Cisco BlackByte 2024)
    • T1078.002 Valid Accounts: Domain Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) captured credentials for or impersonated domain administration users.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1134.003 Access Token Manipulation: Make and Impersonate Token: [BlackByte](https://attack.mitre.org/groups/G1043) constructed a valid authentication token following Microsoft Exchange exploitation to allow for follow-on privileged command execution.(Citation: Microsoft BlackByte 2023)
    • T1543.003 Create or Modify System Process: Windows Service: [BlackByte](https://attack.mitre.org/groups/G1043) modified multiple services on victim machines to enable encryption operations.(Citation: Symantec BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has installed tools such as AnyDesk as a service on victim machines.(Citation: Microsoft BlackByte 2023)
    • T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder: [BlackByte](https://attack.mitre.org/groups/G1043) has used Registry Run keys for persistence.(Citation: Microsoft BlackByte 2023)
  • Stealth TA0005
    • T1036.008 Masquerading: Masquerade File Type: [BlackByte](https://attack.mitre.org/groups/G1043) masqueraded configuration files containing encryption keys as PNG files.(Citation: FBI BlackByte 2022)
    • T1055 Process Injection: [BlackByte](https://attack.mitre.org/groups/G1043) has injected [Cobalt Strike](https://attack.mitre.org/software/S0154) into `wuauclt.exe` during intrusions.(Citation: Picus BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has injected ransomware into `svchost.exe` before encryption.(Citation: Symantec BlackByte 2022)
    • T1055.012 Process Injection: Process Hollowing: [BlackByte](https://attack.mitre.org/groups/G1043) used process hollowing for defense evasion purposes.(Citation: Microsoft BlackByte 2023)
    • T1070.004 Indicator Removal: File Deletion: [BlackByte](https://attack.mitre.org/groups/G1043) deleted ransomware executables post-encryption.(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1078 Valid Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) has gained access to victim environments through legitimate VPN credentials.(Citation: Cisco BlackByte 2024)
    • T1078.002 Valid Accounts: Domain Accounts: [BlackByte](https://attack.mitre.org/groups/G1043) captured credentials for or impersonated domain administration users.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1134.003 Access Token Manipulation: Make and Impersonate Token: [BlackByte](https://attack.mitre.org/groups/G1043) constructed a valid authentication token following Microsoft Exchange exploitation to allow for follow-on privileged command execution.(Citation: Microsoft BlackByte 2023)
    • T1140 Deobfuscate/Decode Files or Information: [BlackByte](https://attack.mitre.org/groups/G1043) has encoded commands in base64-encoded sections concatenated together in PowerShell.(Citation: FBI BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) uses PowerShell commands to disable Windows Defender.(Citation: Picus BlackByte 2022)
    • T1480 Execution Guardrails: [BlackByte](https://attack.mitre.org/groups/G1043) stopped execution if identified language settings on victim machines was Russian or one of several language associated with former Soviet republics.(Citation: Picus BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has used ransomware variants requiring a key passed on the command line for the malware to execute.(Citation: Cisco B
  • Credential Access TA0006
    • T1003 OS Credential Dumping: [BlackByte](https://attack.mitre.org/groups/G1043) used tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) and [Mimikatz](https://attack.mitre.org/software/S0002) to dump credentials from victim systems.(Citation: Picus BlackByte 2022)(Citation: Microsoft BlackByte 2023)
  • Discovery TA0007
    • T1012 Query Registry: [BlackByte](https://attack.mitre.org/groups/G1043) queried registry values to determine system language settings.(Citation: Picus BlackByte 2022)
    • T1016 System Network Configuration Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) used tools such as [Arp](https://attack.mitre.org/software/S0099) to pull system network information and identify connected devices.(Citation: FBI BlackByte 2022)(Citation: Microsoft BlackByte 2023)
    • T1018 Remote System Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) used tools such as [Arp](https://attack.mitre.org/software/S0099) to identify remotely-connected devices.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)
    • T1046 Network Service Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) has used tools such as NetScan to enumerate network services in victim environments.(Citation: Microsoft BlackByte 2023)
    • T1082 System Information Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) used various system commands and tools to pull system information during operations.(Citation: FBI BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)
    • T1087.002 Account Discovery: Domain Account: [BlackByte](https://attack.mitre.org/groups/G1043) has used tools such as [AdFind](https://attack.mitre.org/software/S0552) to identify and enumerate domain accounts.(Citation: Microsoft BlackByte 2023)
    • T1135 Network Share Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) enumerated network shares on victim devices.(Citation: Cisco BlackByte 2024)
    • T1482 Domain Trust Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) enumerated Active Directory information and trust relationships during operations.(Citation: FBI BlackByte 2022)(Citation: Microsoft BlackByte 2023)
    • T1518.001 Software Discovery: Security Software Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) enumerated installed security products during operations.(Citation: Microsoft BlackByte 2023)
    • T1614.001 System Location Discovery: System Language Discovery: [BlackByte](https://attack.mitre.org/groups/G1043) identified system language settings to determine follow-on execution.(Citation: Picus BlackByte 2022)
  • Lateral Movement TA0008
    • T1021.001 Remote Services: Remote Desktop Protocol: [BlackByte](https://attack.mitre.org/groups/G1043) has used RDP to access other hosts within victim networks.(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1021.002 Remote Services: SMB/Windows Admin Shares: [BlackByte](https://attack.mitre.org/groups/G1043) used SMB file shares to distribute payloads throughout victim networks, including BlackByte ransomware variants during wormable operations.(Citation: Picus BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1570 Lateral Tool Transfer: [BlackByte](https://attack.mitre.org/groups/G1043) transfered tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) and the AnyDesk remote access tool during operations using SMB shares.(Citation: Picus BlackByte 2022)
  • Collection TA0009
    • T1560 Archive Collected Data: [BlackByte](https://attack.mitre.org/groups/G1043) compressed data collected from victim environments prior to exfiltration.(Citation: Picus BlackByte 2022)
  • Exfiltration TA0010
    • T1041 Exfiltration Over C2 Channel: [BlackByte](https://attack.mitre.org/groups/G1043) transmitted collected victim host information via HTTP POST to command and control infrastructure.(Citation: Microsoft BlackByte 2023)
    • T1567 Exfiltration Over Web Service: [BlackByte](https://attack.mitre.org/groups/G1043) has used services such as `anonymfiles.com` and `file.io` to exfiltrate victim data.(Citation: Picus BlackByte 2022)
  • Command and Control TA0011
    • T1071.001 Application Layer Protocol: Web Protocols: [BlackByte](https://attack.mitre.org/groups/G1043) collected victim device information then transmitted this via HTTP POST to command and control infrastructure.(Citation: Microsoft BlackByte 2023)
    • T1105 Ingress Tool Transfer: [BlackByte](https://attack.mitre.org/groups/G1043) has transferred tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) to victim environments from file sharing and hosting websites.(Citation: Microsoft BlackByte 2023)
    • T1219 Remote Access Tools: [BlackByte](https://attack.mitre.org/groups/G1043) has used tools such as AnyDesk in victim environments.(Citation: Picus BlackByte 2022)(Citation: Microsoft BlackByte 2023)
  • Impact TA0040
    • T1486 Data Encrypted for Impact: [BlackByte](https://attack.mitre.org/groups/G1043) has encrypted victim files for ransom. Early versions of BlackByte ransomware used a common key for encryption, but later versions use unique keys per victim.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
    • T1490 Inhibit System Recovery: [BlackByte](https://attack.mitre.org/groups/G1043) resized and deleted volume shadow copy files to prevent system recovery after encryption.(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)
    • T1491.001 Defacement: Internal Defacement: [BlackByte](https://attack.mitre.org/groups/G1043) left ransom notes in all directories where encryption takes place.(Citation: FBI BlackByte 2022)
  • Resource Development TA0042
    • T1583.003 Acquire Infrastructure: Virtual Private Server: [BlackByte](https://attack.mitre.org/groups/G1043) staged encryption keys on virtual private servers operated by the adversary.(Citation: FBI BlackByte 2022)
    • T1608.001 Stage Capabilities: Upload Malware: [BlackByte](https://attack.mitre.org/groups/G1043) has staged tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) at public file sharing and hosting sites.(Citation: Microsoft BlackByte 2023)
  • Defense Impairment TA0112
    • T1112 Modify Registry: [BlackByte](https://attack.mitre.org/groups/G1043) performed Registry modifications to escalate privileges and disable security tools.(Citation: Picus BlackByte 2022)(Citation: Cisco BlackByte 2024)
    • T1685 Disable or Modify Tools: [BlackByte](https://attack.mitre.org/groups/G1043) disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Cisco BlackByte 2024)
    • T1686 Disable or Modify System Firewall: [BlackByte](https://attack.mitre.org/groups/G1043) modified firewall rules on victim machines to enable remote system discovery.(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)

Fonte: perfil público do grupo, perfil do grupo · atualizado em 12 nov 2026 · atividade de 04 out 2021 a 30 jul 2025

Vulnerabilidades exploradas 3

CVEs que este grupo é conhecido por explorar, com a fonte e a confiança de cada uma ao lado. Ordenadas pela confiança e pela gravidade real.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK
CVE-2024-37085MEDIUMEPSS 27%KEV MITRE ATT&CK
CVE-2016-6662EPSS 68% MITRE ATT&CK

Sites do grupo

9 site(s) conhecido(s): 0 no ar, 9 fora do ar, 0 apreendido(s).

TipoSituaçãoMudou emEndereço
vazamentofora do arvisto desde 12 nov 2026•••••••• (oculto)
vazamentofora do arvisto desde 12 nov 2026•••••••• (oculto)
vazamentofora do arvisto desde 12 nov 2026•••••••• (oculto)
vazamentofora do arvisto desde 12 nov 2026•••••••• (oculto)
vazamentofora do arvisto desde 12 nov 2026•••••••• (oculto)
vazamentofora do arvisto desde 12 nov 2026•••••••• (oculto)
vazamentofora do arvisto desde 12 nov 2026•••••••• (oculto)
vazamentofora do arvisto desde 12 nov 2026•••••••• (oculto)
Filesfora do arvisto desde 12 nov 2026•••••••• (oculto)
Disponível nos planos SOC, MSSP e Enterprise

Aqui, o endereço de cada site do grupo fica fechado.

Estes planos abrem o conteúdo bruto de inteligência que fica fechado no site:

  • os endereços dos sites de vazamento e de negociação dos grupos;
  • o nome das vítimas;
  • o chat de negociação inteiro;
  • as regras YARA e o pacote de detecção completo de cada grupo;
  • os contatos dos criminosos (e-mail, .onion, Tox) sem máscara.

Também incluem os alertas por webhook, Slack e Discord, o MCP para assistentes de IA e mais volume na API. O Enterprise é sob consulta.

Ver os planos

Fonte: perfil público do grupo · conferido em 12 nov 2026

Notas de resgate 4

O texto que o grupo deixa nas máquinas atacadas, de um acervo público de notas de resgate.

BB_Readme.txt · 2 contato(s) mascarado(s)
██████╗ ██╗ █████╗ ██████╗██╗ ██╗██████╗ ██╗ ██╗████████╗███████╗ ██████╗ ██████╗ 
 ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔══██╗╚██╗ ██╔╝╚══██╔══╝██╔════╝ ╚════██╗ ██╔═████╗
 ██████╔╝██║ ███████║██║ █████╔╝ ██████╔╝ ╚████╔╝ ██║ █████╗ █████╔╝ ██║██╔██║
 ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ██╔══██╗ ╚██╔╝ ██║ ██╔══╝ ██╔═══╝ ████╔╝██║
 ██████╔╝███████╗██║ ██║╚██████╗██║ ██╗██████╔╝ ██║ ██║ ███████╗ ███████╗██╗╚██████╔╝
 ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═════╝ ╚═╝ ╚═╝ ╚══════╝ ╚══════╝╚═╝ ╚═════╝ 

 +-----------------------------------------------------------------------------+
 | All your files have been encrypted, your confidential data has been stolen, |
 | in order to decrypt files and avoid leakage, you must follow our steps. |
 +-----------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------------------------------------------+
 | 1) Download and install TOR Browser from this site: [link] |
 | |
 | 2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need. |
 | |
 | 3) If you read this message thats means your files already for sell in our Auction. |
 | Everyday of delaying will cause higer price. after 4 days if you wont connect us, |
 | We will remove your chat access and you will lose your chance to get decrypted. |
 | |
 +------------------------------------------------------------------------------------------------------------------------------------+

 +---------------------------------------------------------------------------------------------------+
 | Warning! Communication with us occurs only through this link, or through our mail on our Auction. |
 | We also strongly DO NOT recommend using third-party tools to decrypt files, |
 | as this will simply kill them completely without the possibility of recovery. |
 | I repeat, in this case, no one can help you! |
 +---------------------------------------------------------------------------------------------------+


 Your URL: [endereço .onion]:81/[snip]

 Your Key to access the chat: [snip]

 Find our Auction here (TOR Browser): [endereço .onion]
BB_Readme2.txt · 1 contato(s) mascarado(s)
??????? ??? ?????? ?????????? ?????????? ??? ???????????????????? ???? ????????????
 ??????????? ??????????????????? ???????????????? ????????????????????? ????? ????????????
 ??????????? ??????????? ??????? ???????? ??????? ??? ?????? ?????? ??? ??? 
 ??????????? ??????????? ??????? ???????? ????? ??? ?????? ?????????? ??? 
 ??????????????????? ?????????????? ??????????? ??? ??? ???????? ??? ?????? ??? 
 ??????? ??????????? ??? ?????????? ?????????? ??? ??? ???????? ??? ????? ??? 
 

 +-----------------------------------------------------------------------------+
 | All your files have been encrypted, in order to decrypt files, |
 | you must follow our steps. |
 +-----------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------------------------------------------+
 | 1) Download and install TOR Browser from this site: [link] |
 | |
 | 2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need. |
 | |
 | 3) Everyday of delaying will cause higer price. After 4 days if you wont connect us, |
 | We will remove your chat access and you will lose your chance to get decrypted. |
 | |
 +------------------------------------------------------------------------------------------------------------------------------------+

 +---------------------------------------------------------------------------------------------------+
 | We also strongly DO NOT recommend using third-party tools to decrypt files, |
 | as this will simply kill them completely without the possibility of recovery. |
 | I repeat, in this case, no one can help you! |
 +---------------------------------------------------------------------------------------------------+


 Your URL: [endereço .onion]:81/[snip]

 Your Key to access the chat: [snip]
BB_Readme_[rand].txt · 2 contato(s) mascarado(s)
██████╗ ██╗ █████╗ ██████╗██╗ ██╗██████╗ ██╗ ██╗████████╗███████╗ ███╗ ██╗████████╗
 ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔══██╗╚██╗ ██╔╝╚══██╔══╝██╔════╝ ████╗ ██║╚══██╔══╝
 ██████╔╝██║ ███████║██║ █████╔╝ ██████╔╝ ╚████╔╝ ██║ █████╗ ██╔██╗ ██║ ██║ 
 ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ██╔══██╗ ╚██╔╝ ██║ ██╔══╝ ██║╚██╗██║ ██║ 
 ██████╔╝███████╗██║ ██║╚██████╗██║ ██╗██████╔╝ ██║ ██║ ███████╗ ██║ ╚████║ ██║ 
 ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═════╝ ╚═╝ ╚═╝ ╚══════╝ ╚═╝ ╚═══╝ ╚═╝ 
 

 +-----------------------------------------------------------------------------+
 | All your files have been encrypted, your confidential data has been stolen, |
 | in order to decrypt files and avoid leakage, you must follow our steps. |
 +-----------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------------------------------------------+
 | 1) Download and install TOR Browser from this site: [link] |
 | |
 | 2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need. |
 | |
 | 3) If you read this message thats means your files already for sell in our Auction. |
 | Everyday of delaying will cause higer price. after 4 days if you wont connect us, |
 | We will remove your chat access and you will lose your chance to get decrypted. |
 | |
 +------------------------------------------------------------------------------------------------------------------------------------+

 +---------------------------------------------------------------------------------------------------+
 | Warning! Communication with us occurs only through this link, or through our mail on our Auction. |
 | We also strongly DO NOT recommend using third-party tools to decrypt files, |
 | as this will simply kill them completely without the possibility of recovery. |
 | I repeat, in this case, no one can help you! |
 +---------------------------------------------------------------------------------------------------+


 Your URL: [endereço .onion]:81/[snip]

 Your Key to access the chat: [snip]

 Find our Auction here (TOR Browser): [endereço .onion]
blackbyte_v2.txt · 2 contato(s) mascarado(s)
██████╗ ██╗ █████╗ ██████╗██╗ ██╗██████╗ ██╗ ██╗████████╗███████╗
 ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔══██╗╚██╗ ██╔╝╚══██╔══╝██╔════╝
 ██████╔╝██║ ███████║██║ █████╔╝ ██████╔╝ ╚████╔╝ ██║ █████╗ 
 ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ██╔══██╗ ╚██╔╝ ██║ ██╔══╝ 
 ██████╔╝███████╗██║ ██║╚██████╗██║ ██╗██████╔╝ ██║ ██║ ███████╗
 ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═════╝ ╚═╝ ╚═╝ ╚══════╝

 +-----------------------------------------------------------------------------+
 | All your files have been encrypted, your confidential data has been stolen, |
 | in order to decrypt files and avoid leakage, you must follow our steps. |
 +-----------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------------------------------------------+
 | 1) Download and install TOR Browser from this site: [link] |
 | |
 | 2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need. |
 | |
 | 3) If you do not contact us within 4 days, your chat access key won't be valid. |
 | Also, your company will be posted on our blog, darknet and hacker forums, |
 | which will attract unnecessary attention from journalists and not only them. |
 | You are given 4 days to think over the situation, and take reasonable actions on your part. |
 +------------------------------------------------------------------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------+
 | Warning! Communication with us occurs only through this link, or through our mail on our blog. |
 | We also strongly DO NOT recommend using third-party tools to decrypt files, |
 | as this will simply kill them completely without the possibility of recovery. |
 | I repeat, in this case, no one can help you! |
 +------------------------------------------------------------------------------------------------+


 Your URL: [endereço .onion]

 Your Key to access the chat: [snip]

 Find our blog here (TOR Browser): [endereço .onion]
Disponível nos planos SOC, MSSP e Enterprise

Aqui, os contatos dos criminosos nas notas ficam mascarados.

Estes planos abrem o conteúdo bruto de inteligência que fica fechado no site:

  • os endereços dos sites de vazamento e de negociação dos grupos;
  • o nome das vítimas;
  • o chat de negociação inteiro;
  • as regras YARA e o pacote de detecção completo de cada grupo;
  • os contatos dos criminosos (e-mail, .onion, Tox) sem máscara.

Também incluem os alertas por webhook, Slack e Discord, o MCP para assistentes de IA e mais volume na API. O Enterprise é sob consulta.

Ver os planos

Fonte: acervo público de notas de resgate · atualizado em 12 nov 2026

Detecção 1

O pacote que o time de segurança usa para procurar o grupo no próprio ambiente: os indicadores (IOCs) e as regras YARA, de inteligência aberta sobre o grupo.

Regras YARA 1 regra(s)

BlackByte.yar

Disponível nos planos SOC, MSSP e Enterprise

Aqui, as regras YARA e o download do pacote completo (com todos os indicadores) ficam fechados.

Estes planos abrem o conteúdo bruto de inteligência que fica fechado no site:

  • os endereços dos sites de vazamento e de negociação dos grupos;
  • o nome das vítimas;
  • o chat de negociação inteiro;
  • as regras YARA e o pacote de detecção completo de cada grupo;
  • os contatos dos criminosos (e-mail, .onion, Tox) sem máscara.

Também incluem os alertas por webhook, Slack e Discord, o MCP para assistentes de IA e mais volume na API. O Enterprise é sob consulta.

Ver os planos

Conteúdo de defesa: use só em ambientes que você tem autorização para analisar. Fonte: inteligência aberta sobre o grupo · atualizado em 12 nov 2026

Impacto e vítimas

O grupo BlackByte tem 8 vítimas de ransomware conhecidas. Veja os setores e países mais atingidos e as vítimas recentes.

8vítimas conhecidas
4no Brasil
6setores atingidos
Setores mais atacados
Indústria2
Tecnologia2
Agricultura e alimentos1
Educação1
Governo e defesa1
Transporte1
Países mais atingidos
🇧🇷 Brasil4
🇦🇷 Argentina1
🇨🇱 Chile1
🇲🇽 México1
🇵🇪 Peru1
Vítimas recentes
Nome ocultoTecnologia · BR · 2025-07-30
Nome ocultoTecnologia · BR · 2024-09-30
Nome ocultoIndústria · CL · 2023-04-09
Nome ocultoTransporte · BR · 2022-12-29
Nome ocultoIndústria · AR · 2022-11-22
Nome ocultoAgricultura e alimentos · BR · 2022-11-05
Nome ocultoGoverno e defesa · MX · 2022-10-26
Nome ocultoEducação · PE · 2022-10-21

Os nomes das vítimas aparecem nos planos SOC, MSSP e Enterprise. Ver os planos

O grupo BlackByte usa técnicas e explora falhas reais. O Pentest Autônomo com IA da TrueHacking simula esses ataques na sua infraestrutura e traz mais segurança para sua aplicação.

Conhecer o Pentest Autônomo com IA →