Description Summary
Ransomware. Uses dropper written in JavaScript to deploy a .NET payload.
Threat Actor
Assessed linked to Conti/Wizard Spider (MITRE G1043); exploits ProxyShell/ProxyLogon and ESXi CVE-2024-37085; JavaScript dropper → .NET payload.
Technical Indicators
Encryption Extension
.blackbyte
Encryption Algorithm
AES (early: shared key; later unique per-victim keys) + RSA
Ransom Note Name
BlackByte_restoremyfiles.hta / BB_Readme_[ID].txt
Targeted Industries
Critical infrastructure, Manufacturing, Government
First Seen
July 2021
Last Seen
Active (Conti/Wizard Spider lineage)
Geographical Location
United States and worldwide
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |