Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · blackbyte · Crime · ransomware.live + mitre-attack · refreshed 2026-10-06

blackbyte

  • Hecamede

MITRE G1043 ↗

blackbyte — ATT&CK roseBL

attack rose · 48 techniques across 14 tactics

What changed

ledger · newest first
  1. —todaynew CVE6 new CVEs: CVE-2021-26855, CVE-2021-27065, CVE-2021-31207, CVE-2021-34473, CVE-2021-34523, CVE-2024-37085

Analyst brief

ransomware.live + mitre-attack

Ransomware. Uses dropper written in JavaScript to deploy a .NET payload.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

48 techniques · 14 of 15 tactics

  1. Resource development

    2 techniques

  2. Initial access

    1 technique

  3. Execution

    5 techniques

  4. Persistence

    4 techniques

  5. Privilege escalation

    1 technique

  6. Stealth

    9 techniques

  7. Defense impairment

    3 techniques

  8. Credential access

    1 technique

  9. Discovery

    10 techniques

  10. Lateral movement

    3 techniques

  11. Collection

    1 technique

  12. Command and control

    3 techniques

  13. Exfiltration

    2 techniques

  14. Impact

    3 techniques

select a technique

Arsenal

4 malware · 4 tools
Malware
Malware · 4ATT&CK
BlackByte RansomwareS1180 ↗
ExbyteS1179 ↗
BlackByte 2.0 RansomwareS1181 ↗
Cobalt StrikeS0154 ↗
Tools
Tools · 4ATT&CK
AdFindS0552 ↗
ArpS0099 ↗
PsExecS0029 ↗
MimikatzS0002 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs blackbyte is cited as exploiting

none on KEV
  1. CVE-2021-312072026-10-17
    1. “BlackByte ransomware threat actors exploit ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) found in Microsoft Exchange Server to gain initial access to the target network.”

      cited as exploiting · source: picussecurity.com ↗ · 2026-10-17

    2. “In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell ( CVE-2021-34473 , CVE-2021-34523 , and CVE-2021-31207 ) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065 ) vulnerabilities in Microsoft Exchange Servers to gain initial access.”

      cited as exploiting · source: security.com ↗ · 2026-10-17

  2. CVE-2021-345232026-10-17
    1. “BlackByte ransomware threat actors exploit ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) found in Microsoft Exchange Server to gain initial access to the target network.”

      cited as exploiting · source: picussecurity.com ↗ · 2026-10-17

    2. “In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell ( CVE-2021-34473 , CVE-2021-34523 , and CVE-2021-31207 ) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065 ) vulnerabilities in Microsoft Exchange Servers to gain initial access.”

      cited as exploiting · source: security.com ↗ · 2026-10-17

  3. CVE-2021-344732026-10-17
    1. “BlackByte ransomware threat actors exploit ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) found in Microsoft Exchange Server to gain initial access to the target network.”

      cited as exploiting · source: picussecurity.com ↗ · 2026-10-17

    2. “In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell ( CVE-2021-34473 , CVE-2021-34523 , and CVE-2021-31207 ) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065 ) vulnerabilities in Microsoft Exchange Servers to gain initial access.”

      cited as exploiting · source: security.com ↗ · 2026-10-17

  4. CVE-2024-370852026-10-17
    1. “In recent investigations, Talos IR has also observed BlackByte using techniques that depart from their established tradecraft, such as exploiting CVE-2024-37085 – an authentication bypass vulnerability in VMware ESXi – shortly after it was disclosed”

      cited as exploiting · source: blog.talosintelligence.com ↗ · 2026-10-17

    2. “BlackByte has exploited CVE-2024-37085 in VMWare ESXi software for authentication bypass and subsequent privilege escalation.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  5. CVE-2021-270652026-10-17
    1. “In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell ( CVE-2021-34473 , CVE-2021-34523 , and CVE-2021-31207 ) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065 ) vulnerabilities in Microsoft Exchange Servers to gain initial access.”

      cited as exploiting · source: security.com ↗ · 2026-10-17

  6. CVE-2021-268552026-10-17
    1. “In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell ( CVE-2021-34473 , CVE-2021-34523 , and CVE-2021-31207 ) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065 ) vulnerabilities in Microsoft Exchange Servers to gain initial access.”

      cited as exploiting · source: security.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

7 sources
  1. 1.ransomware.live
  2. 2.attack.mitre.org/groups/G1043
  3. 3.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-c…
  4. 4.blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-…
  5. 5.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blac…
  6. 6.security.com/threat-intelligence/blackbyte-exbyte-ransomware
  7. 7.ic3.gov/CSA/2022/220211.pdf

Track blackbyte on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.