S1180: BlackByte Ransomware
BlackByte Ransomware is uniquely associated with BlackByte operations. BlackByte Ransomware used a common key for infections, allowing for the creation of a universal decryptor.[1][2] BlackByte Ransomware was replaced in BlackByte operations by BlackByte 2.0 Ransomware by 2023.[3][4]
Security context for executives and security teams
S1180: BlackByte Ransomware describes [BlackByte Ransomware](https://attack.mitre.org/software/S1180) is uniquely associated with [BlackByte](https://attack.mitre.org/groups/G1043) operations. [BlackByte Ransomware](https://attack.mitre.org/software/S1180) used a common key for infections, allowing for the creation of a universal decryptor.(Citation: Trustwave BlackByte 2021)(Citation: FBI BlackByte 2022) [BlackByte Ransomware](https://attack.mitre.org/software/S1180) was replaced in [BlackByte](https://attack.mitre.org/groups/G1043) operations by [Bla...
Executive priority
S1180: BlackByte Ransomware is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S1180: BlackByte Ransomware by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S1180: BlackByte Ransomware appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
BlackByte Ransomware
BlackByte Ransomware is uniquely associated with BlackByte operations. BlackByte Ransomware used a common key for infections, allowing for the creation of a universal decryptor.[1][2] BlackByte Ransomware was replaced in BlackByte operations by BlackByte 2.0 Ransomware by 2023.[3][4]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1135 | Network Share Discovery | BlackByte Ransomware can identify network shares connected to the victim machine.[1] |
| Enterprise | T1486 | Data Encrypted for Impact | BlackByte Ransomware is ransomware using a shared key across victims for encryption.[1] |
| Enterprise | T1012 | Query Registry | BlackByte Ransomware enumerates the Registry, specifically the `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options` key.[1] |
| Enterprise | T1059.007 | JavaScriptSub-technique | BlackByte Ransomware is distributed as a JavaScript launcher file.[1] |
| Enterprise | T1570 | Lateral Tool Transfer | BlackByte Ransomware spreads itself laterally by writing the JavaScript launcher file to mapped shared folders.[1] |
| Enterprise | T1082 | System Information Discovery | BlackByte Ransomware gathers victim system information to generate a unique victim identifier.[1] |
| Enterprise | T1053.005 | Scheduled TaskSub-technique | BlackByte Ransomware creates a schedule task to execute remotely deployed ransomware payloads.[1] |
| Enterprise | T1490 | Inhibit System Recovery | BlackByte Ransomware deletes all volume shadow copies and restore points among other actions to inhibit system recovery following ransomware deployment.[1] |
| Enterprise | T1689 | Downgrade Attack | BlackByte Ransomware enables SMBv1 during execution.[1] |
| Enterprise | T1046 | Network Service Discovery | BlackByte Ransomware identifies remote systems via active directory queries for hostnames prior to launching remote ransomware payloads.[1] |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | BlackByte Ransomware is distributed as an encrypted payload.[1] |
| Enterprise | T1685 | Disable or Modify Tools | BlackByte Ransomware adds .JS and .EXE extensions to the Microsoft Defender exclusion list. BlackByte Ransomware terminates and removes the Raccine anti-ransomware utility.[1] |
| Enterprise | T1106 | Native API | BlackByte Ransomware uses the `SetThreadExecutionState` API to prevent the victim system from entering sleep.[1] |
| Enterprise | T1222.001 | Windows PermissionsSub-technique | BlackByte Ransomware uses the `mountvol.exe` command to mount volume names and leverages the Microsoft Discretionary Access Control List tool, `icacls.exe`, to grant the group to “Everyone” full access to the root of the drive.[1] |
| Enterprise | T1112 | Modify Registry | BlackByte Ransomware modifies the victim Registry to prevent system recovery.[1] |
| Enterprise | T1480 | Execution Guardrails | BlackByte Ransomware creates a mutex value with a hard-coded name, and terminates if that mutex already exists on the victim system. BlackByte Ransomware checks the system language to see if it matches one of a list of hard-coded values; if a match is found, the malware will terminate.[1] |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | BlackByte Ransomware is distributed as an obfuscated JavaScript launcher file.[1] |
| Enterprise | T1021.002 | SMB/Windows Admin SharesSub-technique | BlackByte Ransomware uses mapped shared folders to transfer ransomware payloads via SMB.[1] |
| Enterprise | T1614.001 | System Language DiscoverySub-technique | BlackByte Ransomware identifies the language on the victim system.[1] |
| Enterprise | T1518.001 | Security Software DiscoverySub-technique | BlackByte Ransomware looks for security software products prior to full execution.[1] |
| Enterprise | T1497.001 | System ChecksSub-technique | BlackByte Ransomware checks for files related to known sandboxes.[1] |
Groups, software, and campaigns
G1043: BlackByte
BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.[1][2][3][4][5]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.0 | Current bundle | 11b8ace2e09d… | ||
| 19.1 | 1.0 | Older bundle | 11b8ace2e09d… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Trustwave BlackByte 2021
Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024.
Open source URL - [2]FBI BlackByte 2022
US Federal Bureau of Investigation & US Secret Service. (2022, February 11). Indicators of Compromise Associated with BlackByte Ransomware. Retrieved December 16, 2024.
Open source URL - [3]Microsoft BlackByte 2023
Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.
Open source URL - [4]Cisco BlackByte 2024
James Nutland, Craig Jackson, Terryn Valikodath, & Brennan Evans. (2024, August 28). BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks. Retrieved December 16, 2024.
Open source URL - [5]mitre-attackS1180Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.