S1179: Exbyte

Exbyte matters because it represents a Windows-focused data exfiltration tool associated in ATT&CK with BlackByte operations. Its practical risk is not just malware execution; it is the movement of collected files to legitimate online file sharing and hosting services, which can blend into normal business traffic and complicate incident scoping.

Executive priority

Prioritize questions around data-loss readiness: which Windows systems can reach external file-sharing services, what sensitive data could be staged or transferred, and whether the SOC can prove what left the environment. This object is especially relevant for ransomware and extortion preparedness, incident response evidence, egress control decisions, and audit conversations about monitoring of high-risk outbound data paths.

Technical view

ATT&CK provides no official detection text for Exbyte, so defenders should validate coverage around its documented behavior and relationships: Windows execution, file and directory discovery, local group discovery, security software discovery, system checks, deobfuscation or decoding activity, file deletion, and exfiltration over web services. SOC and IR teams should correlate host activity that discovers files, permissions, and defenses with unusual outbound transfers to file sharing or hosting services.

Likely telemetry

Windows endpoint process execution and command-line telemetry
File system enumeration, access, staging, and deletion events
Local group and permission discovery events
Security tool or agent discovery indicators on endpoints
Outbound network connection logs, proxy logs, firewall logs, and DNS records

Detection direction

Baseline legitimate use of online file sharing and hosting services, then investigate unusual upload volume, new destinations, uncommon processes, or sensitive hosts initiating transfers.
Correlate discovery behaviors before exfiltration: local group queries, file and directory enumeration, and security software discovery can increase confidence when seen near suspicious outbound web-service traffic.
Account for blind spots caused by SSL/TLS, approved cloud storage access, limited endpoint logging, and file deletion after activity.
Tune carefully for business-approved file sharing to reduce false positives while maintaining higher scrutiny for servers, privileged workstations, and systems containing regulated or business-critical data.

Mitigation priorities

Review and restrict outbound access to unsanctioned file sharing and hosting services where business requirements allow.
Enforce least privilege around local groups and administrative access so discovery of permissions yields less useful opportunity.
Improve endpoint and network logging retention to support exfiltration investigations, especially for Windows hosts handling sensitive data.
Apply data handling controls such as classification, monitoring, and egress review for high-value repositories.
Prepare IR playbooks to preserve host, proxy, DNS, and firewall evidence quickly because file deletion is part of the related behavior set.

Additional notes and limits

The supplied ATT&CK object identifies Exbyte as a Go-based exfiltration tool associated with BlackByte operations and observed since 2022. The strongest defensive value is to treat it as a data-theft and ransomware-readiness use case: validate whether discovery activity and web-service exfiltration can be connected in telemetry before an incident.

ATT&CK provides no official detection guidance for this object, no aliases, no explicit tactics on the malware object, and only Windows as the supported platform for Exbyte. Recommendations are inferred from the official description and listed technique relationships, not from guaranteed indicators or vendor-specific detections.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Exbyte

Exbyte is an exfiltration tool written in Go that is uniquely associated with BlackByte operations. Observed since 2022, Exbyte transfers collected files to online file sharing and hosting services.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques9 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1106	Native API	Exbyte calls `ShellExecuteW` with the `IpOperation` parameter `RunAs` to launch `explorer.exe` with elevated privileges.[2]
Enterprise	T1480	Execution Guardrails	Exbyte checks for the presence of a configuration file before completing execution.[2]
Enterprise	T1069.001	Local GroupsSub-technique	Exbyte checks whether the process is running with privileged local access during execution.[2]
Enterprise	T1140	Deobfuscate/Decode Files or Information	Exbyte decodes and decrypts data stored in the configuration file with a key provided on the command line during execution.[2]
Enterprise	T1083	File and Directory Discovery	Exbyte enumerates all document files on an infected machine, then creates a summary of these items including filename and directory location prior to exfiltration to cloud hosting services.[1]
Enterprise	T1518.001	Security Software DiscoverySub-technique	Exbyte checks for the presence of various security software products during execution.[1]
Enterprise	T1070.004	File DeletionSub-technique	Exbyte will self-delete if a hard-coded configuration file is not found.[2]
Enterprise	T1497.001	System ChecksSub-technique	Exbyte performs various checks to determine if it is running in a sandboxed environment to prevent analysis.[1]
Enterprise	T1567	Exfiltration Over Web Service	Exbyte exfiltrates collected data to online file hosting sites such as `Mega.co.nz`.[1][2]

Associated objects

Groups, software, and campaigns

G1043: BlackByte

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.[1][2][3][4][5]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.1
Object version: 1.0
Created: Dec 17, 2024, 00:18 UTC (UTC+00:00)
Modified: Mar 9, 2025, 16:02 UTC (UTC+00:00)
Raw hash: 0de86a4d0a023006...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.0	Mar 9, 2025, 16:02 UTC (UTC+00:00)	Current bundle	`0de86a4d0a02…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Symantec BlackByte 2022
Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.
Open source URL
[2]
Microsoft BlackByte 2023
Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
Open source URL
[3]
Symantec BlackByte 2022
Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.
Open source URL
[4]
Symantec BlackByte 2022
Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.
Open source URL
[5]
mitre-attackS1179
Open source URL
[6]
mitre-attackS1179
Open source URL
[7]
mitre-attackS1179
Open source URL
[8]
Microsoft BlackByte 2023
Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
Open source URL
[9]
Microsoft BlackByte 2023
Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
Open source URL
[10]
Microsoft BlackByte 2023
Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
Open source URL
[11]
Microsoft BlackByte 2023
Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
Open source URL
[12]
Microsoft BlackByte 2023
Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
Open source URL
[13]
Microsoft BlackByte 2023
Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
Open source URL
[14]
Microsoft BlackByte 2023
Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
Open source URL
[15]
Symantec BlackByte 2022
Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.
Open source URL
[16]
Symantec BlackByte 2022
Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.
Open source URL
[17]
Symantec BlackByte 2022
Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.
Open source URL
[18]
Symantec BlackByte 2022
Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.
Open source URL
[19]
Microsoft BlackByte 2023
Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
Open source URL
[20]
Microsoft BlackByte 2023
Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
Open source URL
[21]
Symantec BlackByte 2022
Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.
Open source URL
[22]
Symantec BlackByte 2022
Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.
Open source URL
[23]
Microsoft BlackByte 2023
Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
Open source URL
[24]
Microsoft BlackByte 2023
Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
Open source URL
[25]
Symantec BlackByte 2022
Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.
Open source URL
[26]
Microsoft BlackByte 2023
Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
Open source URL
[27]
Symantec BlackByte 2022
Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use