BlackByte
IntrusionSet · ATTACK:enterprise:G1043
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1043",
"title": "BlackByte",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1043",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--02b16bd6-ae88-417a-8a3f-02c5e166175a",
"external_id": "G1043",
"domain": "enterprise",
"created": "2024-12-16T23:19:40.207Z",
"modified": "2026-07-31T18:47:34.923Z",
"version": "1.0",
"aliases": [
"BlackByte",
"Hecamede"
],
"tactics": [
],
"source_references": [
{
"source_name": "Hecamede"
},
{
"source_name": "Picus BlackByte 2022",
"url": "https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"
},
{
"source_name": "Cisco BlackByte 2024",
"url": "https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"
},
{
"source_name": "Microsoft BlackByte 2023",
"url": "https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"
},
{
"source_name": "Symantec BlackByte 2022",
"url": "https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"
},
{
"source_name": "FBI BlackByte 2022",
"url": "https://www.ic3.gov/CSA/2022/220211.pdf"
}
]
}Explicit source assertions (56)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--093c0ace-8e89-4948-8aab-f7b484347f6a
Microsoft BlackByte 2023 · Symantec BlackByte 2022 · FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c6913d6-f4a4-49cc-8458-cd876c429865
Microsoft BlackByte 2023 · FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d79b40d-3ff5-42d6-a135-6e6555890a23
Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e7999e0-a0d4-4f08-be18-8db59a46f69e
Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1002e4b9-a9c0-403d-ad81-692b34474dc0
Microsoft BlackByte 2023 · FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1686
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10b52204-b034-4f79-b64c-3a01426221d5
Picus BlackByte 2022 · Symantec BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1036.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2cc5f406-1bfd-427d-b8a0-dae6c93c8757
FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d478e66-fa0d-4834-8b17-5761369e9867
Picus BlackByte 2022 · FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1134.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e8408d8-2a8b-4f5e-9457-0fc254f4e83e
Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--323ab0a8-1ae7-4754-a47d-f4c0978dea10
Picus BlackByte 2022 · Cisco BlackByte 2024 · Microsoft BlackByte 2023 · Symantec BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3515a90d-cb4c-4bc0-8d19-de781061487f
Microsoft BlackByte 2023 · Symantec BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fee3584-9887-428b-83e9-76caab0d0f0c
Cisco BlackByte 2024 · Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--417d46c4-2fed-4722-81dd-5f936787d2db
Picus BlackByte 2022 · Cisco BlackByte 2024 · FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--433a58df-14b4-4fc1-ace7-7610369b7094
Picus BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ad19c3f-54c6-4bc6-a6fc-95ffb6fe75be
Picus BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b716af9-f423-4744-9d88-e4f942d991a5
FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1136.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--531c1d10-cdfc-4977-a10c-f84bcbc0357c
Cisco BlackByte 2024ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56b203da-eda9-4866-8a69-f978a1d34821
Picus BlackByte 2022 · Cisco BlackByte 2024ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cacb853-971b-4bde-8719-dd300fe5aac4
Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64f429bb-7ddd-473a-8408-7fa0ba9282e3
Microsoft BlackByte 2023 · Symantec BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a02ffe3-2c0d-4d47-a10f-892797c568ea
FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6cb4aa00-2992-4068-8992-50bd4c3947dd
Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d55d9e0-34cb-43fe-bbd4-8dd2c88fec54
Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:S1180
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72720894-aa70-4e8a-8697-b29235174ed5
Microsoft BlackByte 2023 · Trustwave BlackByte 2021ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76eaadac-791f-41de-a105-9c29247c0b95
Picus BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1583.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7712ca00-da29-4b3a-938d-82b362814a78
FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cd37736-47d4-4d56-8398-bd4104f43cb9
Picus BlackByte 2022 · Microsoft BlackByte 2023 · Symantec BlackByte 2022 · FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--828a7a9c-4ee2-4e63-80ae-e127a22f8b7d
Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ab39b8c-44af-4ec5-ab8e-1a94142a2f7b
Picus BlackByte 2022 · Symantec BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:S1179
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b62eae4-0d81-4c46-8952-c0235f816c49
Microsoft BlackByte 2023 · Symantec BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:S0099
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f097447-429c-4a28-b333-78936f11e0c0
FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a1da7be-9aaf-495a-bd56-f196f26b6240
Picus BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ffbd639-bdd2-48f1-b9a6-dd5a63f70960
Microsoft BlackByte 2023 · FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3ff5dc8-8edf-4b2f-b253-3126c4c50a20
Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7752cff-83f3-4a19-b92a-77201882cea4
Picus BlackByte 2022 · Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7aa8345-4b70-43aa-924c-bb7d1caf2c7f
Cisco BlackByte 2024 · Symantec BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9d3ddcc-36fa-44d8-9a0a-07688467a137
Cisco BlackByte 2024ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2d68c37-be6c-49e4-917a-3a8e22a97e54
Picus BlackByte 2022 · FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b61e2c68-4f0e-420d-8e58-989f8f3e83cd
Cisco BlackByte 2024ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:S1181
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b73c4228-8df8-4671-98f9-c7eca0ccb13c
Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--baaa98d7-25a4-47ae-9b60-dad129def3bf
Picus BlackByte 2022 · Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:S0029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc56eda5-37e8-4478-a0e6-ea73fc6a57ed
Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4b47c6e-2a98-4b46-a0dc-39d40361e3f7
Cisco BlackByte 2024ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:S0154
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb245afb-7787-4fc4-9ca6-0089c2d4251b
Picus BlackByte 2022 · Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1567
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0c16df8-1610-4737-a807-cc431169f6cd
Picus BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d58f4ef7-4d27-48ba-989d-06b835edae9a
Picus BlackByte 2022 · Symantec BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6523780-3cae-483e-ae54-f9383b60dc0e
Picus BlackByte 2022 · Cisco BlackByte 2024 · Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7770d18-bb2c-4a78-bf3f-a9abb1a58862
Cisco BlackByte 2024 · Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7c2abc3-4f02-438f-b146-731351135075
Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc906a37-e2f5-4e8f-8f3c-317ad667d484
Picus BlackByte 2022 · Cisco BlackByte 2024ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1d5115c-126f-4fc2-b28f-6031c0d1ca70
Picus BlackByte 2022 · Cisco BlackByte 2024 · Microsoft BlackByte 2023 · Symantec BlackByte 2022 · FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3e8e452-6e3f-4b2d-a9aa-00fc0573f804
Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e56fc7da-b0f8-4f18-99f4-e4b8b3258c9b
Picus BlackByte 2022 · Microsoft BlackByte 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e725b4a0-9efd-4960-a05c-f2f184b25840
FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--edabd2c1-4640-4cad-b23f-c2ea4e64c7d5
Picus BlackByte 2022 · FBI BlackByte 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ffa16031-220f-4bb3-9be4-241b4b43b53e
Microsoft BlackByte 2023