Procedure examples

BlackByte used tools such as Cobalt Strike and Mimikatz to dump credentials from victim systems.

BlackByte queried registry values to determine system language settings.

BlackByte used tools such as Arp to pull system network information and identify connected devices.

BlackByte used tools such as Arp to identify remotely-connected devices.

BlackByte has used RDP to access other hosts within victim networks.

BlackByte used SMB file shares to distribute payloads throughout victim networks, including BlackByte ransomware variants during wormable operations.

BlackByte masqueraded configuration files containing encryption keys as PNG files.

BlackByte transmitted collected victim host information via HTTP POST to command and control infrastructure.

BlackByte has used tools such as NetScan to enumerate network services in victim environments.

BlackByte used WMI to delete Volume Shadow Copies on victim machines.

BlackByte created scheduled tasks for payload execution.

BlackByte has injected Cobalt Strike into `wuauclt.exe` during intrusions. BlackByte has injected ransomware into `svchost.exe` before encryption.

BlackByte used process hollowing for defense evasion purposes.

BlackByte used encoded PowerShell commands during operations. BlackByte has used remote PowerShell commands in victim networks.

BlackByte executed ransomware using the Windows command shell.

BlackByte has exploited CVE-2024-37085 in VMWare ESXi software for authentication bypass and subsequent privilege escalation.

BlackByte deleted ransomware executables post-encryption.

BlackByte collected victim device information then transmitted this via HTTP POST to command and control infrastructure.

BlackByte has gained access to victim environments through legitimate VPN credentials.

BlackByte captured credentials for or impersonated domain administration users.

BlackByte used various system commands and tools to pull system information during operations.

BlackByte has used tools such as AdFind to identify and enumerate domain accounts.

BlackByte has transferred tools such as Cobalt Strike to victim environments from file sharing and hosting websites.

BlackByte performed Registry modifications to escalate privileges and disable security tools.

BlackByte constructed a valid authentication token following Microsoft Exchange exploitation to allow for follow-on privileged command execution.

BlackByte enumerated network shares on victim devices.

BlackByte created privileged domain accounts during intrusions.

BlackByte has encoded commands in base64-encoded sections concatenated together in PowerShell. BlackByte uses PowerShell commands to disable Windows Defender.

BlackByte exploited vulnerabilities such as ProxyLogon and ProxyShell for initial access to victim environments.

BlackByte has used tools such as AnyDesk in victim environments.

BlackByte stopped execution if identified language settings on victim machines was Russian or one of several language associated with former Soviet republics. BlackByte has used ransomware variants requiring a key passed on the command line for the malware to execute.

BlackByte enumerated Active Directory information and trust relationships during operations.

BlackByte has encrypted victim files for ransom. Early versions of BlackByte ransomware used a common key for encryption, but later versions use unique keys per victim.

BlackByte resized and deleted volume shadow copy files to prevent system recovery after encryption.

BlackByte left ransom notes in all directories where encryption takes place.

BlackByte has used ASPX web shells following exploitation of vulnerabilities in services such as Microsoft Exchange.

BlackByte enumerated installed security products during operations.

BlackByte modified multiple services on victim machines to enable encryption operations. BlackByte has installed tools such as AnyDesk as a service on victim machines.

BlackByte has used Registry Run keys for persistence.

BlackByte compressed data collected from victim environments prior to exfiltration.

BlackByte has used services such as `anonymfiles.com` and `file.io` to exfiltrate victim data.

BlackByte created malicious services for ransomware execution.

BlackByte transfered tools such as Cobalt Strike and the AnyDesk remote access tool during operations using SMB shares.

BlackByte staged encryption keys on virtual private servers operated by the adversary.

BlackByte has staged tools such as Cobalt Strike at public file sharing and hosting sites.

BlackByte identified system language settings to determine follow-on execution.

BlackByte disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.

BlackByte modified firewall rules on victim machines to enable remote system discovery.