G1043 · ATT&CK 20.0 group
BlackByte
Aliases: BlackByte, Hecamede
[BlackByte](https://attack.mitre.org/groups/G1043) is a ransomware threat actor operating since at least 2021. [BlackByte](https://attack.mitre.org/groups/G1043) is associated with several versions of ransomware also labeled [BlackByte Ransomware](https://attack.mitre.org/software/S1180). [BlackByte](https://attack.mitre.org/groups/G1043) ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as [BlackByte 2.0 Ransomware](https://attack.mitre.org/software/S1181) use more robust encryption mechanisms. [BlackByte](https://attack.mitre.org/groups/G1043) is notable for operations targeting critical infrastructure entities among other targets across North America.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)
Aliases: BlackByte, Hecamede
ATT&CK techniques
T1003T1012T1016T1018T1021.001T1021.002T1036.008T1041T1046T1047T1053.005T1055T1055.012T1059.001T1059.003T1068T1070.004T1071.001T1078T1078.002T1082T1087.002T1105T1112T1134.003T1135T1136.002T1140T1190T1219T1480T1482T1486T1490T1491.001T1505.003T1518.001T1543.003T1547.001T1560T1567T1569.002T1570T1583.003T1608.001T1614.001T1685T1686
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PsExec tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Arp tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Cobalt Strike tool reference — Explicit actor uses software relationship in pinned ATT&CK
- AdFind tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1003 OS Credential Dumping simulation — Exact active technique ID
- T1003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1012 Query Registry simulation — Exact active technique ID
- T1012 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1016 System Network Configuration Discovery simulation — Exact active technique ID
- T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1018 Remote System Discovery simulation — Exact active technique ID
- T1018 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
- T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.002 SMB/Windows Admin Shares simulation — Exact active technique ID
- T1021.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.008 Masquerade File Type simulation — Exact active technique ID
- T1036.008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1041 Exfiltration Over C2 Channel simulation — Exact active technique ID
- T1041 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1046 Network Service Discovery simulation — Exact active technique ID
- T1046 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1047 Windows Management Instrumentation simulation — Exact active technique ID
- T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.005 Scheduled Task simulation — Exact active technique ID
- T1053.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1055 Process Injection simulation — Exact active technique ID
- T1055 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1055.012 Process Hollowing simulation — Exact active technique ID
- T1055.012 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.003 Windows Command Shell simulation — Exact active technique ID
- T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1068 Exploitation for Privilege Escalation simulation — Exact active technique ID
- T1068 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.001 Web Protocols simulation — Exact active technique ID
- T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.002 Domain Accounts simulation — Exact active technique ID
- T1078.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.002 Domain Account simulation — Exact active technique ID
- T1087.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1112 Modify Registry simulation — Exact active technique ID
- T1112 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1134.003 Make and Impersonate Token simulation — Exact active technique ID
- T1134.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1135 Network Share Discovery simulation — Exact active technique ID
- T1135 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1136.002 Domain Account simulation — Exact active technique ID
- T1136.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
- T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1219 Remote Access Tools simulation — Exact active technique ID
- T1219 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1480 Execution Guardrails simulation — Exact active technique ID
- T1480 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1482 Domain Trust Discovery simulation — Exact active technique ID
- T1482 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1486 Data Encrypted for Impact simulation — Exact active technique ID
- T1486 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1490 Inhibit System Recovery simulation — Exact active technique ID
- T1490 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1491.001 Internal Defacement simulation — Exact active technique ID
- T1491.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1505.003 Web Shell simulation — Exact active technique ID
- T1505.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1518.001 Security Software Discovery simulation — Exact active technique ID
- T1518.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1543.003 Windows Service simulation — Exact active technique ID
- T1543.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560 Archive Collected Data simulation — Exact active technique ID
- T1560 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1567 Exfiltration Over Web Service simulation — Exact active technique ID
- T1567 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1569.002 Service Execution simulation — Exact active technique ID
- T1569.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1570 Lateral Tool Transfer simulation — Exact active technique ID
- T1570 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.003 Virtual Private Server simulation — Exact active technique ID
- T1583.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1608.001 Upload Malware simulation — Exact active technique ID
- T1608.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1614.001 System Language Discovery simulation — Exact active technique ID
- T1614.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685 Disable or Modify Tools simulation — Exact active technique ID
- T1685 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1686 Disable or Modify System Firewall simulation — Exact active technique ID
- T1686 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWeakness taxonomy and vulnerability identity
Vulnerability Research & Exploit Development · topic-matchData classification, storage, cryptography, keys, backup, and deletion
Cloud Security · topic-match
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWeakness taxonomy and vulnerability identity
Vulnerability Research & Exploit Development · topic-matchData classification, storage, cryptography, keys, backup, and deletion
Cloud Security · topic-match