BlackByte is a ransomware operation that gets in through weak VPN accounts and unpatched Exchange servers, takes domain admin within days, and was exploiting the VMware ESXi "ESX Admins" authentication bypass within days of its disclosure. MITRE ATT&CK tracks the group as G1043 and describes it as operating since at least 2021, notable for targeting critical infrastructure in North America. The FBI and US Secret Service warned in February 2022 that it had hit at least three US critical infrastructure sectors, and Microsoft and Cisco Talos have since documented intrusions that went from first access to encryption in under five days. This profile is for SOC analysts, Active Directory and virtualisation administrators and incident responders. It covers names and versions, targeting, ATT&CK techniques, the heavy reliance on accounts and credentials, dated events and a prioritised defence plan. The hypervisor response steps are in the ESXi Ransomware Playbook; this page covers what is specific to BlackByte.
Key takeaways
- Identity is the entry and the engine. Talos saw a brute-forced VPN account with a weak password and no MFA as the likely way in, then two Domain Admin-level accounts, NTLM authentication and credentials embedded in the encryptor for self-propagation.
- ESXi falls through Active Directory. Talos assesses BlackByte created the "ESX Admins" group to exploit CVE-2024-37085, which gives full ESXi administrator rights to members of any domain group with that name.
- Defences are switched off deliberately. The group disabled Microsoft Defender through the registry, uninstalled EDR by hand and used up to four vulnerable drivers, including RTCore64.sys, to kill security tools.
- The timeline is short. Microsoft Incident Response documented a BlackByte 2.0 intrusion from ProxyShell exploitation to encryption in less than five days.
- The leak site undercounts it. Talos estimates only 20 to 30 per cent of successful BlackByte attacks result in a leak site post, so absence from the site says little about activity.
Who they are (names and aliases)
| Name or version | Source | What it refers to |
|---|---|---|
| BlackByte (G1043) | MITRE ATT&CK, FBI and USSS | The ransomware-as-a-service (RaaS) operation, active since at least 2021. |
| Hecamede | MITRE ATT&CK (associated group) | Alias listed by ATT&CK. |
| BlackByte Ransomware (S1180) | ATT&CK, FBI | Original encryptor distributed as an obfuscated JavaScript launcher, using a common key across victims, which allowed a universal decryptor. Replaced by 2023. |
| BlackByte 2.0 Ransomware (S1181) | ATT&CK, Microsoft | Replacement with no common key; uses a vulnerable driver, process hollowing into svchost.exe and network spread through PsExec. |
| BlackByteNT | Cisco Talos, 2024 | C and C++ encryptor following earlier C# and Go versions; appends the extension blackbytent_h. |
| Exbyte (S1179) | ATT&CK, Symantec, Microsoft | Go-based exfiltration tool that uploads collected files to file hosting services such as Mega. |
For how ransomware brands split and rebrand, see the Ransomware Family Lineage and Rebrands Guide, and for the business model the Ransomware-as-a-Service Business Model Guide.
Targeting and motivation
- Critical infrastructure: the FBI and USSS advisory of 11 February 2022 reported that, as of November 2021, BlackByte had compromised US and foreign businesses including entities in at least three US critical infrastructure sectors: government facilities, financial, and food and agriculture.
- Opportunistic access: victims were reached through exposed Microsoft Exchange servers (ProxyLogon and ProxyShell, per ATT&CK and Microsoft) and internet-facing VPNs with weak accounts (Talos).
- Language guardrails: ATT&CK records that the ransomware stops if the system language is Russian or one of several languages associated with former Soviet republics.
- Motivation: financial, through double extortion: data is exfiltrated before encryption and ransom notes in every encrypted directory point to a .onion payment site (FBI).
Tactics and techniques (MITRE ATT&CK)
From ATT&CK v20 group G1043 and software S1180 and S1181. All IDs were checked against the v20 dataset, including the Defense Impairment techniques introduced in v20.
| Tactic | Technique | BlackByte behaviour |
|---|---|---|
| Initial access | T1190 Exploit Public-Facing Application; T1078 Valid Accounts | ProxyLogon and ProxyShell on Exchange; legitimate VPN credentials. |
| Persistence | T1505.003 Web Shell; T1547.001 Registry Run Keys; T1543.003 Windows Service; T1136.002 Domain Account | ASPX web shells on Exchange; Run key DLL backdoor; AnyDesk installed as a service; new privileged domain accounts. |
| Privilege escalation | T1134.003 Make and Impersonate Token; T1068 Exploitation for Privilege Escalation | Valid token built after Exchange exploitation; CVE-2024-37085 against ESXi; vulnerable driver abuse. |
| Credential access | T1003 OS Credential Dumping | Mimikatz and Cobalt Strike credential dumping. |
| Discovery | T1087.002 Domain Account; T1482 Domain Trust Discovery; T1046 Network Service Discovery; T1518.001 Security Software Discovery | AdFind, NetScan and Arp; enumeration of installed security products. |
| Defense impairment | T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall; T1689 Downgrade Attack | Defender and Raccine disabled, Defender exclusions added; firewall rules changed; SMBv1 enabled by the original encryptor. |
| Stealth | T1055.012 Process Hollowing; T1480 Execution Guardrails; T1070.004 File Deletion | Hollowing into svchost.exe; language checks and key requirement; ransomware deletes itself. |
| Lateral movement | T1021.001 RDP; T1021.002 SMB/Windows Admin Shares; T1570 Lateral Tool Transfer | RDP and PowerShell remoting; payloads and AnyDesk pushed over SMB shares; PsExec for wormable spread. |
| Command and control | T1219 Remote Access Tools; T1071.001 Web Protocols | AnyDesk; Cobalt Strike; HTTP POST of host data. |
| Exfiltration | T1567 Exfiltration Over Web Service | Exbyte uploads to Mega; services such as file.io and anonymfiles.com. |
| Impact | T1490 Inhibit System Recovery; T1486 Data Encrypted for Impact | Shadow copies resized or deleted through vssadmin and WMI; encryption of local drives and shares. |
How they abuse identities and credentials
Nearly every stage of a BlackByte intrusion depends on an account. That is good news for defenders, because identity telemetry gives several chances to stop it before encryption.
Weak remote access accounts
In the 2024 intrusion Talos analysed, the actor logged into the victim's VPN with valid credentials, most likely obtained by brute forcing an internet-facing service. The account had a basic naming convention and a weak password and may not have been subject to MFA because of how Active Directory was configured. The same failure is behind the Colonial Pipeline Ransomware Attack 2021, where an unused VPN account without MFA was enough. See the MFA Guide.
Domain admin and NTLM
- Privileged accounts: Talos found two Domain Admin-level accounts compromised, one used against vCenter. ATT&CK records that BlackByte captured credentials for or impersonated domain administrators and created new privileged domain accounts.
- NTLM as a tell: the actor authenticated mainly with NTLM while legitimate users used Kerberos, which Talos notes may indicate pass-the-hash. See the Pass-the-Hash and Pass-the-Ticket Guide and the NTLM Deprecation and Elimination Guide.
- Credentials inside the malware: BlackByte 2.0 can spread network-wide through PsExec using hardcoded domain admin credentials (Microsoft), and BlackByteNT embeds victim credentials for self-propagation (Talos). Exbyte carried embedded credentials for the Mega upload account.
ESXi through the directory: CVE-2024-37085
Microsoft explains that ESXi hosts joined to Active Directory treat members of a domain group named "ESX Admins" as full administrators, matching by name rather than SID, and that the group does not exist by default. Any user able to create a group with that name and add themselves gains ESXi administrator rights. Talos saw BlackByte create AD computer objects for the ESXi hosts, create the group and add several accounts to it, within days of disclosure. CISA added CVE-2024-37085 to the KEV catalogue on 30 July 2024 and marks it as known to be used in ransomware campaigns. Microsoft's interim mitigations include confirming the group exists and is locked down, changing the ESXi admin group, and reviewing the advanced setting Config.HostAgent.plugins.hostsvc.esxAdminsGroupAutoAdd. See the VMware ESXi Hardening Guide.
Notable incidents
| When | Event | Source |
|---|---|---|
| 2021 | Original encryptor analysed; its common key allowed a universal decryptor. | Trustwave, cited by ATT&CK |
| 11 February 2022 | FBI and USSS joint advisory CU-000163-MW with indicators, noting at least three US critical infrastructure sectors affected and Exchange exploitation by some victims. | FBI and USSS |
| 2022 | Exbyte custom exfiltration tool documented. | Symantec, cited by ATT&CK |
| 6 July 2023 | Microsoft publishes a BlackByte 2.0 case: ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) to encryption in under five days, with Cobalt Strike, AnyDesk, Exbyte and RTCore64.sys. | Microsoft Incident Response |
| 28 August 2024 | Talos reports BlackByteNT, four vulnerable drivers, VPN brute force, NTLM use and exploitation of CVE-2024-37085. | Cisco Talos |
Detection and defence
Priority controls, in order
- Close the front doors. Require MFA on every VPN and remote access account and deny authentication that matches no policy by default (Talos). Patch internet-facing Exchange and remove legacy VPN accounts. Track KEV entries for CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 and CVE-2024-37085.
- Protect privileged groups. Alert on any change to Domain Admins, Enterprise Admins and any group named "ESX Admins" (Windows Event IDs 4728, 4732 and 4756 for member additions, 4727 and 4731 for group creation). Pre-create and lock down the ESX Admins group or change the ESXi admin group as Microsoft advises.
- Restrict NTLM and harden SMB. Limit NTLM, enforce Kerberos, disable SMBv1 and enforce SMB signing and encryption (Talos). See the SMB Protocol Security and Signing Guide.
- Make security tools hard to turn off. Enable Defender tamper protection (Microsoft found it disabled in the 2023 case), protect EDR uninstall with a password, and enable the Microsoft vulnerable driver blocklist. See the Bring Your Own Vulnerable Driver and EDR Killers Guide.
- Keep backups out of reach. The FBI advisory calls for air-gapped, password-protected backups that cannot be modified or deleted from systems holding the original data.
Detection opportunities
| Signal | Telemetry | Behaviour |
|---|---|---|
| Bursts of failed VPN logins then success on a low-activity account | VPN, RADIUS or IdP logs | Brute force to T1078 |
| Privileged accounts authenticating with NTLM where Kerberos is normal | Event ID 4624 with NTLM package, DC logs | Possible pass-the-hash |
| Creation of "ESX Admins" or new computer objects for ESXi hosts | AD audit logs, Event ID 4727 or 4731, 4741 | CVE-2024-37085 preparation |
| New ASPX files in Exchange or IIS web directories; IIS GET and POST to them | File integrity monitoring, IIS logs | Web shell (FBI IOC category) |
| Registry changes disabling Defender, new Defender exclusions for .exe or .js | Defender event 5007, EDR | T1685 |
| Loading of RTCore64.sys, DBUtil_2_3.sys, zamguard64.sys or gdrv.sys | EDR driver load events, Sysmon Event ID 6 | Vulnerable driver abuse |
| AnyDesk installed as a service on servers | Event ID 7045, EDR | T1219, T1543.003 |
| vssadmin or WMI shadow copy deletion; deletion of taskmgr.exe or resmon.exe | EDR process events | T1490 and pre-encryption tampering |
| Large uploads to Mega, file.io or similar from servers | Proxy, firewall, DNS | T1567 exfiltration |
Load the indicators from the FBI and USSS advisory into the SIEM as it recommends, but treat hashes as short-lived: the behaviours above survive new encryptor versions. If tampering is detected, follow the EDR Tampering and BYOVD Response Playbook.
Framework mapping: account controls map to NIST SP 800-53 AC-2 (Account Management) and AC-6 (Least Privilege) and CSF 2.0 PR.AA-05; MFA on remote access to IA-2 and AC-17; anti-tamper to SI-3 (Malicious Code Protection); backups to CP-9 and PR.DS-11; segmentation to SC-7.
Metrics: percentage of VPN accounts with MFA enforced (target 100); count of dormant remote access accounts over 30 days (target zero); percentage of privileged authentications using NTLM; mean time to alert on privileged group changes (target minutes); percentage of servers with tamper protection and the vulnerable driver blocklist enabled.
Practitioner checklist
- Enforce MFA on every VPN account and remove or disable accounts not used in 30 days.
- Patch Exchange and ESXi against the KEV-listed CVEs named on this page and confirm with a scan.
- Create and lock down an "ESX Admins" group or reconfigure the ESXi admin group, and alert on any change to it.
- Alert on privileged group membership changes and on privileged NTLM logons.
- Turn on Defender tamper protection, EDR uninstall protection and the vulnerable driver blocklist.
- Block or alert on unapproved remote access tools such as AnyDesk on servers.
- Keep immutable or offline backups of servers and hypervisors and test restores.
- Document enterprise-wide password and Kerberos ticket reset procedures, including krbtgt, before you need them.
Standards and references
- FBI and US Secret Service: Indicators of Compromise Associated with BlackByte Ransomware
- MITRE ATT&CK: BlackByte (G1043)
- CISA: Known Exploited Vulnerabilities Catalog
- Microsoft: The five-day job: A BlackByte ransomware intrusion case study
- Microsoft: Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption
- Cisco Talos: BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Ransomware Groups Guide · ESXi Ransomware Playbook · Active Directory Domain Compromise Response Playbook · Ransomware Prevention Guide