BlackByte

Names and who uses them

• BlackByteOur name
• HecamedeSymantec

Targets

Sectors: Critical infrastructure

Regions: North America

Known techniques

• T1003OS Credential Dumping
• T1012Query Registry
• T1016System Network Configuration Discovery
• T1018Remote System Discovery
• T1021.001Remote Desktop Protocol
• T1021.002SMB/Windows Admin Shares
• T1036.008Masquerade File Type
• T1041Exfiltration Over C2 Channel
• T1046Network Service Discovery
• T1047Windows Management Instrumentation
• T1053.005Scheduled Task
• T1055Process Injection
• T1055.012Process Hollowing
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1068Exploitation for Privilege Escalation
• T1070.004File Deletion
• T1071.001Web Protocols
• T1078Valid Accounts
• T1078.002Domain Accounts
• T1082System Information Discovery
• T1087.002Domain Account
• T1105Ingress Tool Transfer
• T1112Modify Registry
• T1134.003Make and Impersonate Token
• T1135Network Share Discovery
• T1136.002Domain Account
• T1140Deobfuscate/Decode Files or Information
• T1190Exploit Public-Facing Application
• T1219Remote Access Tools
• T1480Execution Guardrails
• T1482Domain Trust Discovery
• T1486Data Encrypted for Impact
• T1490Inhibit System Recovery
• T1491.001Internal Defacement
• T1505.003Web Shell
• T1518.001Security Software Discovery
• T1543.003Windows Service
• T1547.001Registry Run Keys / Startup Folder
• T1560Archive Collected Data

Malware and tools used