The first known version of BlackByte was written in C#. This allowed researchers to create a decrypter to help BlackByte victims, thus forcing the group to change their encryption method in newer variants.

It also used AES, a symmetric key algorithm. The earlier variant of BlackByte used the same key in each campaign to encrypt files. We have listed down the key highlights of BlackByte here: While BlackByte operators use their piece of ransomware in attacks for their own gain, they also run on a ransomware-as-a-service (RaaS) model for their affiliates. What do organizations need to know about BlackByte?

However, like LockBit, RansomEXX, and many other ransomware families, BlackByte avoids attacking Russia-based entities. With the purported shut down of Conti, researchers from AdvIntel surmise that BlackByte is one of the chief new ransomware variants part of its rebranding.Īt present, BlackByte continues to target organizations from all over the world. This however did not stop BlackByte as developers released newer versions that used multiple keys and ramped up operations, going as far as to warn their victims against using the available decrypter on their website.īlackByte’s emergence could be part of a larger scheme. On October 2021, Trustwave released a publicly available decrypter for BlackByte. This advisory shows just how BlackByte was actively establishing itself as a new noteworthy ransomware variant. According to a joint advisory by these two government agencies, BlackByte had already gone after at least three US critical infrastructure sectors (government facilities, financial, and food and agriculture) by November 2021. Its first year of activity garnered the attention of the Federal Bureau of Investigation (FBI) and the US Secret Service (USS). View infographic of 'Ransomware Spotlight: BlackByte'īlackByte debuted in July 2021. Like its contemporaries, it has gone after critical infrastructure for a higher chance of a getting a payout. BlackByte is a ransomware group that has been building a name for itself since 2021.

Solid explorer work with zoolz