BlackByte Ransomware — Malware Profile

BlackByte Ransomware is uniquely associated with BlackByte operations. BlackByte Ransomware used a common key for infections, allowing for the creation of a universal decryptor. BlackByte Ransomware was replaced in BlackByte operations by BlackByte 2.0 Ransomware by 2023.

MITRE ATT&CK techniques (21)

• T1012 Query Registry
• T1021.002 SMB/Windows Admin Shares
• T1027.013 Encrypted/Encoded File
• T1046 Network Service Discovery
• T1053.005 Scheduled Task
• T1059.007 JavaScript
• T1082 System Information Discovery
• T1106 Native API
• T1112 Modify Registry
• T1135 Network Share Discovery
• T1140 Deobfuscate/Decode Files or Information
• T1222.001 Windows Permissions
• T1480 Execution Guardrails
• T1486 Data Encrypted for Impact
• T1490 Inhibit System Recovery
• T1497.001 System Checks
• T1518.001 Security Software Discovery
• T1570 Lateral Tool Transfer
• T1614.001 System Language Discovery
• T1685 Disable or Modify Tools
• T1689 Downgrade Attack

IntelFusions coverage

• BlackByte Ransomware Evolves: Four Vulnerable Drivers, ESXi Zero-Day Exploitation, and Victim Credentials Baked Into the Payload 2026-02-16

Attributed threat actors

• BlackByte

Read the full analysis on IntelFusions