Blackbyte

Parsing : Enabled

Known to be a RaaS

Description

BlackByte ransomware was first observed in July 2021 and operates as a Ransomware-as-a-Service (RaaS). It uses a double-extortion model—encrypting victim files while exfiltrating sensitive data for publication on its Tor-based leak site. The ransomware is written in C# and uses AES-256 for file encryption, with keys protected by RSA public-key encryption. Early variants exploited the ProxyShell vulnerability in Microsoft Exchange servers for initial access, but later campaigns have leveraged phishing, malicious attachments, and vulnerable internet-facing systems. BlackByte appends extensions such as .blackbyte or .blackbyte2.0 to encrypted files and leaves ransom notes (BlackByte_restoremyfiles.txt) instructing victims to contact them via Tor. The group has targeted organizations worldwide, including critical infrastructure, manufacturing, and government sectors. In February 2022, the FBI and USSS released a joint advisory warning about BlackByte’s impact and offering detection signatures.

External Analysis
https://blog.talosintelligence.com/2022/05/the-blackbyte-ransomware-group-is.html
https://de.darktrace.com/blog/detecting-the-unknown-revealing-uncategorised-ransomware-using-darktrace
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf
https://redcanary.com/blog/blackbyte-ransomware/
https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/
https://securelist.com/modern-ransomware-groups-ttps/106824/
https://therecord.media/san-francisco-49ers-confirm-ransomware-attack/
https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape
https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group
https://www.advintel.io/post/hydra-with-three-heads-blackbyte-the-future-of-ransomware-subsidiary-groups
https://www.bleepingcomputer.com/news/security/fbi-blackbyte-ransomware-breached-us-critical-infrastructure/
https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/
https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape
https://www.ic3.gov/Media/News/2022/220211.pdf
https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure
https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/trellix-global-defenders-analysis-and-protections-for-blackbyte-ransomware.html
https://www.trendmicro.com/vinfo/my/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte
https://www.zscaler.com/blogs/security-research/analysis-blackbyte-ransomwares-go-based-variants
Mail
BlackBCruxSupport@onionmail.org
Urls
Screen
http://6iaj3efye3q62xjgfxyegrufhewxew7yt4scxjd45tlfafyja6q4ctqd.onion
http://f5uzduboq4fa2xkjloprmctk7ve3dm46ff7aniis66cbekakvksxgeqd.onion
http://dlyo7r3n4qy5fzv4645nddjwarj7wjdd6wzckomcyc7akskkxp4glcad.onion
http://fl3xpz5bmgzxy4fmebhgsbycgnz24uosp3u4g33oiln627qq3gyw37ad.onion
http://jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion/
Screen
http://53d5skw4ypzku4bfq2tk2mr3xh5yqrzss25sooiubmjz67lb3gdivcad.onion/
Screen
http://ce6roic2ykdjunyzazsxmjpz5wsar4pflpoqzntyww5c2eskcp7dq4yd.onion/
File servers
Screen
http://tj3ty2q5jm5au3bmd2embtjscd3qjt7nfio2o7cr6moyy5kgil5pieqd.onion
Screen
http://kpfj3bmo77bwpy2f5zzwj4knatueuv7t3ldlpp4tlrmv2buiziw2tdyd.onion
Chat servers
Screen
http://a2dbso6dijaqsmut36r6y4nps4cwivmfog5bpzf6uojovce6f3gl36id.onion:81
http://vzzf6yg67cffqndnwg56e4psw45rup45f2mis7bwblg5fs7e5voagsqd.onion:81
http://inbukcc4xk67uzbgkzufdqq3q3ikhwtebqxza5zlfbtzwm2g6usxidqd.onion:81
http://p5quu5ujzzswxv4nxyuhgg3fjj2vy2a3zmtcowalkip2temdfadanlyd.onion/
Admin servers
Screen

Posts

Date Title Description Screen
2025-07-29
DARA Pharma Dara Pharmaceutical designs, develops, and manufactures packaging equipment for washing, sterilizing, filling, freeze-drying, and closing machines for vials, bottles, syringes, cartridges, and IV Bags to process liquid, semi-solid products, and powders in sterile conditions.
2025-07-29
Lee & Associates In 1979, Bill Lees vision became reality when he opened the first office of Lee & Associates in Orange County, California. Every Lee office is owned and operated by the real estate professionals, all of whom benefit from the sharing of real-time market intelligence that is vital to the delivery of superior commercial real estate services. The unique service platform has attracted some of the most experienced and talented real estate professionals in the industry, all of whom share Bills original vision of superior service through teamwork. Our offices offer a broad array of real estate services tailored to meet the needs of the companys clients in each of the markets it serves. They include commercial real estate brokerage, property management, valuation, asset management and finance. Now the largest firm of its kind in North America, the companys reach extends across the United States and Canada.
2025-07-18
GreenLight Biosciences Founded in 2008, GreenLight Bioscience is a pre-commercial stage synthetic biology company with a proprietary cell-free ribonucleic acid (RNA) production platform for the discovery, development and commercialization of high-performing products. The company is based in Medford, Massachusetts.
2025-07-18
T2 Group We are people that value the journey towards excellence, actively seeking individuals who share this commitment — both within our team and among our clients. In collaboration, we operate as a unified force, sharing the ambition to achieve remarkable results that outshine the competition, redefine industries, and make meaningful impact.
2025-07-18
Ark Consultancy ARK Consultancy Limited is a leading management and technical consultancy specializing in social housing, dedicated to supporting local authorities and housing associations throughout the UK. They offer a wide range of services that include asset management, decarbonization, resident engagement, and strategic governance.
2025-07-18
Allstarmg Founded in 1999, Allstar Marketing Group is a Performance Marketing company that has been directly responsible for some of the most successful consumer products in history. Allstar works with brands who are on the precipice of becoming a household name, but are unable to market and distribute to retail at a larger scale.
2025-07-18
Helpsonv HELP of Southern Nevada provides assistance to families and individuals in overcoming barriers to self-sufficiency through various direct services, training, and referrals to community resources. Their offerings include adult and family housing programs, behavioral health services, and a diaper bank, among others.
2024-09-30
TOTVS
2024-07-17
Modernauto
2024-06-23
City of Newburgh
2024-03-14
Encina Wastewater Authority
2023-10-05
Meridian Cooperative
2023-09-18
Hoteles Xcaret
2023-09-12
Alps Alpine
2023-09-09
Kirby Risk
2023-09-08
FOCUS Business Solutions
2023-09-08
Chambersburg Area School District
2023-09-06
Smead
2023-08-24
Ontellus
2023-07-05
Avalign Technologies
2023-07-03
Brett Martin
2023-06-16
Kisco Senior Living
2023-06-16
Multistack
2023-06-15
Fiege Sp. z o.o.
2023-06-15
NEBRASKALAND
2023-06-15
The Texwipe
2023-06-15
YAMAHA CORPORATION OF AMERICA
2023-05-26
City of Augusta
2023-05-17
Magic-Aire
2023-05-12
Sterling Solutions
2023-05-04
PRESS-SERVICE Monitoring Mediów
2023-04-25
Dacotah Paper
2023-04-23
Easy Automation
2023-04-15
Esperanza Viva Jóvenes de México
2023-04-15
Gulliver International
2023-04-15
Saobacdau Technologies Group
2023-04-09
City of Collegedale
2023-04-09
Creation Baumann
2023-04-09
Crown Grinding & Machining
2023-04-09
Cementos Bio-Bio
2023-03-20
Kelly Group
2023-03-16
Etex Communications
2023-03-09
Falcon Holdings
2023-03-08
Wagner CAT
2023-02-12
Inland Group
2023-02-07
Penn Power Group
2023-01-17
ARC
2023-01-14
K2 Sports
2023-01-06
Kansas City Homes
2023-01-05
Ellison Technologies
2023-01-05
Hayward
2023-01-04
CAPMC
2022-12-29
CPTM
2022-11-23
lapiamontesa
2022-11-08
ALTEK
2022-11-05
PETERSON & HANSON
2022-11-05
Broto Legal
2022-10-29
Asahi Group
2022-10-26
CCLint
2022-10-26
Municipio de Chihuahua
2022-10-21
UNE
2022-10-21
Pitman Family Farms
2022-10-01
Swiss American
2022-10-01
Almoayed ICT
2022-09-18
Biggest News
2022-09-18
South Pacific Inc
2022-09-11
Davin Industries Ltd
2022-09-11
TIB Development Bank
2022-09-05
Speed-Buster
2022-09-01
Alan Smith
2022-08-29
GMX
2022-08-29
Torin Drive
2022-08-29
Grande Stevens
2022-08-18
Apex Capital Corp
2022-04-04
Bud Griffin and Associates
2022-04-04
Petrolimex
2022-04-04
Rector Hayden Realtors
2022-04-04
Taylor and Martin
2022-04-04
Argonaut Gold
2022-04-04
Prince Jewellery & Watch Co., Ltd.
2022-04-04
Aeronamic
2022-04-04
Venture Machine & Tool, Inc.
2022-04-04
San Francisco 49ers
2022-04-04
INVIMA
2022-04-04
Diamond Pet Foods
2022-04-04
MZ Architects
2022-04-04
GEBE
2022-04-04
Autumn Transport
2022-04-04
h1{
2021-12-30
Visage Imaging
2021-12-29
Williams & Rowe Company, Inc.
2021-12-29
P&R ENTERPRISES
2021-12-19
Kangean Energy Indonesia
2021-12-19
Dental Health Products
2021-12-09
P&R ENTERPRISES
2021-12-09
Unique Home Solutions
2021-12-09
Quanticate
2021-12-06
Bemis Associates
2021-11-30
Karges-Faulconbridge, Inc.
2021-11-30
MOTOR VEHICLE ACCIDENT FUND PENSION FUND
2021-11-30
Koltepatil
2021-11-23
Goodwill of Central and Coastal Virginia, Inc.
2021-11-23
INOXPA
2021-11-15
Canada West Land
2021-11-15
Emery Jensen Distribution
2021-11-15
Purifoy Chevrolet Co.
2021-11-15
Williams & Rowe Company, Inc.
2021-11-13
Visage Imaging
2021-11-13
ASPECT STUDIOS ASIA PTY LTD
2021-11-13
The Glass House
2021-11-07
Statcomm
2021-11-03
Regence Footwear
2021-10-31
Napili Kai Foundation Gallery
2021-10-28
H Hotels Collection
2021-10-25
MINT Investments
2021-10-23
DiGioia Gray & Associates, LLC
2021-10-19
GENERALE PREFABBRICATI SPA
2021-10-16
Goss Dodge Chrysler Ram Jeep
2021-10-15
Medical Designs
2021-10-15
Statcomm
2021-10-12
Distribuidora de Industrias Nacionales
2021-10-04
Tom Lange Company, Inc.
2021-10-04
Farmers Cooperative Elevator
2021-10-04
Aluflexpack
2021-10-04
Clay County Clerk
2021-10-04
AZA chili
2021-10-04
BOSCA S.p.A
2021-10-04
The Plastic Forming Company
2021-10-04
GEO-Alpinbau
2021-10-04
Goss Dodge Chrysler Ram Jeep
2021-10-04
Matic Transport