{"id":2107,"date":"2024-09-25T11:29:18","date_gmt":"2024-09-25T11:29:18","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=2107"},"modified":"2025-07-29T03:19:24","modified_gmt":"2025-07-29T03:19:24","slug":"how-to-slow-down-the-blackbyte-ransomware","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/how-to-slow-down-the-blackbyte-ransomware\/","title":{"rendered":"How to Slow Down the Blackbyte Ransomware"},"content":{"rendered":"
\n
\"black-byte-ransomware\"<\/figure>\n<\/div>\n\n\n

Since July 2021, numerous US, European, and Australian intrusions have been attributed to the BlackByte ransomware group. Attacks have been launched against manufacturing companies, financial services, key infrastructure providers, and most recently an American football club. BlackByte is believed to be headquartered in Russia because it’s meant to avoid organisations where the system default language is Russian or another language from the Commonwealth of Independent States. LMNTRIX CDC recently observed that BlackByte attackers used Microsoft Exchange Server ProxyShell & Proxylogon vulnerabilities to gain initial access as part of the infection process.<\/p>\n\n\n\n

The malware is coded in Golang which has become popular among threat actors in the last 3 years.<\/p>\n\n\n\n

Targets: <\/strong> BlackByte ransomware has infected victims all over the world, from North America to Colombia, the Netherlands, China, Mexico and Vietnam.<\/p>\n\n\n\n

Impact of Blackbyte Ransomware<\/h3>\n\n\n\n

Numerous users in Russia have had their accounts hacked by the Blackbyte ransomware variant. Tens of thousands of email accounts have been compromised as a result of an attack on the largest web mail service in the nation using this malware as a service. According to the FBI\u2019s Joint Cyber Security Advisory, \u201cBlackByte ransomware had compromised multiple US and foreign businesses, including entities in at least three US critical infrastructure sectors (government facilities, financial, and food & agriculture). BlackByte is a Ransomware as a Service (RaaS) group that encrypts files on compromised Windows host systems, including physical and virtual servers.\u201d In order to develop a more effective protection strategy against BlackByte, it is helpful to be aware of the major steps it takes to infiltrate target networks.<\/p>\n\n\n\n

Initial Access Phase<\/h3>\n\n\n\n

The BlackByte group’s playbook, much like Conti ransomware group, focuses on exploiting known vulnerabilities in public-facing server infrastructures such as Exchange. The fact that traffic to and from these services has been encrypted with the transport layer security makes detecting exploitation attempts difficult for most of the security controls deployed by a typical SMB organization.<\/p>\n\n\n\n

Organizations should keep an eye out for and patch any vulnerabilities affecting publicly accessible infrastructure, such as Proxy Shell and Proxy Logon, which is used by BlackByte group. Security teams should be vigilant and, whenever possible, monitor encrypted communication, such as TLS 1.2 and 1.3 with full fidelity request forwarding, to make sure that attackers cannot conceal their attempts at exploitation.<\/p>\n\n\n\n

Exploitation by BlackByte<\/h3>\n\n\n\n

Like many cyber criminals, the BlackByte gang depends on Cobalt Strike toolkit to supply the essential components for their attack, exploitation, or post-exploitation stages. After successfully breaching your perimeter defense, an attacker will concentrate and start intelligence gathering on the inside, next steps of lateral movement, and privilege escalation during the post exploitation phase will follow. Communicating later with the designated command and control server, another round of recon and\/or evasion is inevitable, as these capabilities are offered by penetration testing tools like Cobalt Strike in a beautifully packaged manner even to a non-technical attacker. Ransomware groups like BlackByte are able to quickly move laterally, compromise many systems, and disable security features like EDR and remote logging by utilizing packaged tools and well-known attack vectors. Due to the lack of attention given to internal network security, in terms of detection and response, it has always been challenging to identify the lateral movement and off-the-grid approaches. Many companies are trying to encrypt all internal traffic, which exacerbates a difficult situation by widening the visibility gap and giving attackers more time.<\/p>\n\n\n\n

A BlackByte ransomware affiliate recently started using “ExByte<\/strong>“, an info-stealer to steal data from Windows devices quickly. ExByte allows BlackByte ransomware to upload exfiltrated data to mega.co.nz for double extortion. BlackByte as well as other ransomware gain unauthorized access, steal data from victims and threaten to delete, OR leak data unless they get paid.<\/p>\n\n\n\n

Cyber Defense Tactics To Slow Down BlackByte<\/h3>\n\n\n\n

Security Operation teams must adopt visibility and detection techniques like strategic decryption with the presumption that their network has already been infiltrated. Decryption of frequently exploited protocols, such as SMBv3, MS-RPC, NTLM, and Kerberos, is essential for limiting an attacker’s capacity to operate covertly and assisting in the discovery of harmful behavior. Speed of incident response is a real factor when it comes to responding while combating harmful attacks such as Blackbyte. It is crucial to decisively take action to limit the spread of malicious behavior, but it’s also equally crucial to make sure that the action is precise enough to reduce any unintended damage to an organization’s infrastructure.<\/p>\n\n\n\n

Security tools can identify malicious behavior by detecting lateral movement, network enumeration, and efforts to some extent. However, as companies try to expand encryption to internal network traffic, many IT \/ Security Operation teams are losing sight of these strategies. Integrating security products like endpoint detection next-gen antivirus, network detection and response (NDR), with traditional and web application firewalls, cloud based SSO for identity and access management (IAM), machine learning, threat intelligence and a unified control such as eXtended Detection & Response (XDR) can ensure  security operation teams respond swiftly to malicious activity with greater control.<\/p>\n\n\n\n

BlackByte Ransomware Attack<\/strong><\/h3>\n\n\n\n

In addition to encrypting local file systems and network file sharing, ransomware attacks also commonly steals data that is essential to business operations before encrypting it. For defenders, with little to no visibility, this offers a variety of potential detection challenges.<\/p>\n\n\n\n

A late-stage sign of many ransomware attacks, including BlackByte, is the exfiltration of data to anonymous file-sharing websites. BlackByte is infamous for uploading substantial amounts of customer data to file-sharing websites which they later exploit to demand further payments from their victims. It would be noteworthy to mention, that a good XDR solution can spot every step of the attack from initial access to data exfiltration.<\/p>\n\n\n\n

Encryption of network file shares, like data exfiltration, generates distinct traffic patterns that good security products can use to detect “active” ransomware activity. In the case of BlackByte, the ransomware creates ransom notes with instructions on how to contact the attackers, pay the ransom, and decrypt the user’s files.<\/p>\n\n\n\n

Following are examples of anonymizer websites used by BlackByte,<\/p>\n\n\n\n

    \n
  • Anonymfiles[.]com<\/li>\n\n\n\n
  • file[.]io.<\/li>\n<\/ul>\n\n\n\n

    We have outlined a few simple Indicators of Compromise, for BlackByte that anybody can use;<\/p>\n\n\n\n

      \n
    • BlackByte_restoremyfiles.hta – the ransomware note<\/li>\n\n\n\n
    • Encrypted files with the extension “*.blackbyte”<\/li>\n<\/ul>\n\n\n\n

      Mitigation Strategy for BlackByte<\/strong><\/h3>\n\n\n\n

      Conventional prevention strategies often lack the capability required to stop a ransomware infection. LMNTRIX recommends the company to use better access controls, segment the network and training users to identify phishing attempts on a regular basis. That being said, the complexity of implementing and managing a security program and, the limited gains associated with user training as a partially effective strategy can\u2019t be ruled out.<\/p>\n\n\n\n

      LMNTRIX believes that businesses must understand that a layered approach to cyber security is still required to defend against advanced attackers, such as BlackByte. Instead of adopting a post-compromise security mindset, organisations should develop a process and leverage tooling to detect attackers at every stage of the kill chain (think XDR). This includes endpoint detection and response, NGAV, threat intelligence, machine learning, underground intelligence, and network detection and response (or network visibility tools), which are required to detect cyber intrusions and lateral movement, allowing Security and Operations teams to slow down an attack before a full-scale breach can occur. No single security product is capable of addressing the breadth of the modern threat landscape. As part of your security program, your company must constantly evaluate the IT organization’s security posture, and adapt as conditions evolve.<\/p>\n\n\n\n

      General mitigation steps, for Ransomware, according to LMNTRIX playbook are as follows:<\/strong><\/p>\n\n\n\n

        \n
      • Implement regular backups of all data to be stored as password protected copies offline.<\/li>\n\n\n\n
      • Ensure these copies are not accessible for modification or deletion, from any system where the original data resides.<\/li>\n\n\n\n
      • Implement network segmentation such as VLAN, a control that ensures all machines on your network are not accessible from every other machine.<\/li>\n\n\n\n
      • Install and regularly update antivirus and EDR software on all hosts, enable real time detection and take action when you see an alert. Triage the alert, validate and close the incident ticket with proper containment and remediation steps.<\/li>\n\n\n\n
      • Install security updates & patch your operating systems, software, and firmware as soon as updates\/patches are released by the vendors.<\/li>\n\n\n\n
      • Audit all user accounts with administrative privileges and configure access controls with the principle of least privilege in mind. Do NOT give administrative privilege to all users.<\/li>\n\n\n\n
      • Disable unused remote access\/Remote Desktop Protocol (RDP) ports and monitor remote access\/RDP logs for any unusual activity.<\/li>\n\n\n\n
      • Disable HTML email, and remove any\/all hyperlinks in received emails.<\/li>\n\n\n\n
      • Use double authentication, or a MFA control, when logging into accounts or services.<\/li>\n\n\n\n
      • Ensure that routine security auditing is conducted for all accounts.<\/li>\n\n\n\n
      • Ensure all the identified IOCs are fed into the network firewall, web app firewall, EDR, IDS\/IPS, SIEM for continuous monitoring, and stay vigilant when an alert pops up. Use your incident response process to validate alerts, prioritize alerts and remediate security threats.<\/li>\n<\/ul>\n\n\n\n

        Conclusion<\/strong><\/h2>\n\n\n\n

        BlackByte is considered as one of the “big game” ransomware groups, they target large and high-profile organizations by not only exfiltrating their data, but also threatening to publicly leak it on dark-web websites, if the unsuspecting mark doesn’t pay the demanded ransom amount.<\/p>\n\n\n\n

        We would like to conclude, with a sober note, a ransomware group has needs that must be met in order to be successful. In order to compromise your systems, network and data, the attacker needs to obtain unauthorized access to the \u201ctarget\u201d systems, storing critical \/ confidential data. The attackers must then establish command and control, identify weak points within your network, and move laterally.<\/p>\n\n\n\n

        LMNTRIX strongly believes, with a steady stream of BlackByte attacks identified globally in early 2022, the human operators behind the Ransomware as a Service are likely to continue to attack and extort organizations increasingly in the near future. A security control such as XDR, operated by a skilled human team, will have an opportunity to counter the ransomware operators at every step to detect, contain, respond & remediate emerging threats before they can cause significantly costly breaches.<\/p>\n\n\n\n

         <\/p>\n\n\n\n

        Appendix A<\/strong><\/p>\n\n\n\n

        Vulnerabilities exploited by the Blackbyte Group;<\/strong><\/p>\n\n\n\n

        CVE Number<\/strong><\/td>CVSS Score<\/strong><\/td>Vulnerability<\/strong><\/td><\/tr>
        CVE-2021-34473<\/a><\/td>9.8 (Critical)<\/td>Microsoft Exchange Server Remote Code Execution Vulnerability<\/td><\/tr>
        CVE-2021-34523<\/a><\/td>9.8 (Critical)<\/td>Microsoft Exchange Server Elevation of Privilege Vulnerability<\/td><\/tr>
        CVE-2021-31207<\/a><\/td>7.2 (High)<\/td>Microsoft Exchange Server Security Feature Bypass Vulnerability<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

        Appendix B<\/strong><\/p>\n\n\n\n

        Anti Analysis Checks performed by BlackByte Ransomware<\/strong>;<\/p>\n\n\n\n

        BlackByte can detect standard analysis tools and intends to evade them, using the standard API checks, the malware calls the IsDebuggerPresent and CheckRemoteDebuggerPresent API. This development makes BlackByte and its affiliates more dangerous, especially since the Exbyte program checks to make sure it is not in an analysis environment before stopping, making it hard to detect\/debug.<\/p>\n\n\n\n

        ImmunityDBG
        OllyDBG
        MegaDumper
        Import Reconstructor
        WinDBG
        IDA Pro<\/p>\n\n\n\n

        It also performs checks for the following traditional antivirus software,<\/strong><\/p>\n\n\n\n

        avghooka.dll
        avghookx.dll
        sxin.dll
        sf2.dll
        sbiedll.dll
        snxhk.dll
        cmdvrt32.dll
        cmdvrt64.dll
        wpespy.dll
        vmcheck.dll
        pstorec.dll
        dir_watch.dll
        api_log.dll
        dbghelp.dll<\/p>\n\n\n\n

        The BlackByte sample we examined also calls NetSetInformationThreadW with undocumented value ThreadHideFromDebugger to hide the main thread from debuggers. Threat actors behind Blackbyte and similar ransomware groups want to make it more difficult for security researchers to analyze the malware sample, and hence the anti-analysis checks.<\/p>\n\n\n\n

        <\/p>\n\n\n\n

        Appendix C<\/strong><\/p>\n\n\n\n

        Indicators of Compromise for Detecting BlackByte Ransomware<\/strong><\/h3>\n\n\n\n

        Registry Keys Added<\/strong><\/p>\n\n\n\n

        reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \/v LocalAccountTokenFilterPolicy \/t REG_DWORD \/d 1 \/f<\/p>\n\n\n\n

        reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \/v EnableLinkedConnections \/t REG_DWORD \/d 1 \/f<\/p>\n\n\n\n

        reg add HKLM\\SYSTEM\\CurrentControlSet\\Control\\FileSystem \/v LongPathsEnabled \/t REG_DWORD \/d 1 \/f<\/p>\n\n\n\n

        IP Address<\/strong><\/p>\n\n\n\n

        185.93.6.31<\/p>\n\n\n\n

        45.9.148.114<\/p>\n\n\n\n

        MD5 Hashes<\/strong><\/p>\n\n\n\n

        4d2da36174633565f3dd5ed6dc5033c4<\/p>\n\n\n\n

        cd7034692d8f29f9146deb3641de7986<\/p>\n\n\n\n

        d63a7756bfdcd2be6c755bf288a92c8b<\/p>\n\n\n\n

        eed7357ab8d2fe31ea3dbcf3f9b7ec74<\/p>\n\n\n\n

        695e343b81a7b0208cbae33e11f7044c<\/p>\n\n\n\n

        296c51eb03e70808304b5f0e050f4f94<\/p>\n\n\n\n

        0c7b8da133799dd72d0dbe3ea012031e<\/p>\n\n\n\n

        a77899602387665cddb6a0f021184a2b<\/p>\n\n\n\n

        1473c91e9c0588f92928bed0ebf5e0f4<\/p>\n\n\n\n

        28b791746c97c0c04dcbfe0954e7173b<\/p>\n\n\n\n

        52b8ae74406e2f52fd81c8458647acd8<\/p>\n\n\n\n

        1785f4058c78ae3dd030808212ae3b04<\/p>\n\n\n\n

        b8e24e6436f6bed17757d011780e87b9<\/p>\n\n\n\n

        8dfa48e56fc3a6a2272771e708cdb4d2<\/p>\n\n\n\n

        4ce0bdd2d4303bf77611b8b34c7d2883<\/p>\n\n\n\n

        c010d1326689b95a3d8106f75003427c<\/p>\n\n\n\n

        ae6fbc60ba9c0f3a0fef72aeffcd3dc7<\/p>\n\n\n\n

        405cb8b1e55bb2a50f2ef3e7c2b28496<\/p>\n\n\n\n

        11e35160fc4efabd0a3bd7a7c6afc91b<\/p>\n\n\n\n

        659b77f88288b4874b5abe41ed36380d<\/p>\n\n\n\n

        151c6f04aeff0e00c54929f25328f6f7<\/p>\n\n\n\n

        959a7df5c465fcd963a641d87c18a565<\/p>\n\n\n\n

        5f40e1859053b70df9c0753d327f2cee<\/p>\n\n\n\n

        df7befc8cdc3c5434ef27cc669fb1e4b<\/p>\n\n\n\n

        51f2cf541f004d3c1fa8b0f94c89914a<\/p>\n\n\n\n

        d9e94f076d175ace80f211ea298fa46e<\/p>\n\n\n\n

        8320d9ec2eab7f5ff49186b2e630a15f<\/p>\n\n\n\n

        cea6be26d81a8ff3db0d9da666cd0f8f<\/p>\n\n\n\n

        31f818372fa07d1fd158c91510b6a077<\/p>\n\n\n\n

        d9e94f076d175ace80f211ea298fa46e<\/p>\n\n\n\n

        a9cf6dce244ad9afd8ca92820b9c11b9<\/p>\n\n\n\n

        7139415fecd716bec6d38d2004176f5d<\/p>\n\n\n\n

        c13bf39e2f8bf49c9754de7fb1396a33<\/p>\n\n\n\n

        ad29212716d0b074d976ad7e33b8f35f<\/p>\n\n\n\n

        d4aa276a7fbe8dcd858174eeacbb26ce<\/p>\n\n\n\n

        58e8043876f2f302fbc98d00c270778b<\/p>\n\n\n\n

        d2a15e76a4bfa7eb007a07fc8738edfb<\/p>\n\n\n\n

        e46bfbdf1031ea5a383040d0aa598d45<\/p>\n\n\n\n

        <\/p>\n\n\n\n

        This lab article is a living blog post… We will update this blog post, as appropriate.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

        Since July 2021, numerous US, European, and Australian intrusions have been attributed to the BlackByte ransomware group. Attacks have been launched against manufacturing companies, financial services, key infrastructure providers, and most recently an American football club. BlackByte is believed to be headquartered in Russia because it’s meant to avoid organisations where the system default language […]<\/p>\n","protected":false},"author":1,"featured_media":2108,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-2107","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/comments?post=2107"}],"version-history":[{"count":4,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2107\/revisions"}],"predecessor-version":[{"id":4204,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2107\/revisions\/4204"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media\/2108"}],"wp:attachment":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media?parent=2107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/categories?post=2107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/tags?post=2107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}