BlackByte first appeared in mid-2021 and within months had accumulated enough victims to draw a joint FBI and USSS advisory. The group’s early version had a significant operational flaw — it reused the same AES encryption key across all victims in a campaign, which meant that once researchers obtained the key from any victim, they could decrypt all victims from the same campaign. Trustwave released a decryptor leveraging this weakness in October 2021. BlackByte’s response was to fix the key reuse vulnerability and upgrade its tooling. The group that operated from mid-2022 onward was meaningfully more capable than its predecessor.
Origins and Attribution
BlackByte’s affiliation model is distinct from the large RaaS platforms. The group appears to operate with a small, stable affiliate base rather than recruiting broadly through underground forums. This keeps operational security tighter and the victim pool more selective. BlackByte’s targeting has consistently prioritised critical infrastructure sectors — CISA advisory AA22-321A, issued February 2022, specifically flagged attacks on critical infrastructure entities across multiple sectors including government, finance, food and agriculture, and transportation.
The group maintains a Tor-based data leak site where victim data is published after ransom negotiations fail. Unlike some groups that progressively release partial data to pressure victims, BlackByte has at times given shorter ultimatums before full publication.
Technical Profile
Encryptor (v1, 2021): BlackByte’s initial ransomware was written in C# targeting .NET environments. It fetched an encryption key file from a remote URL during execution. Because the key fetching mechanism used the same URL and thus the same key across a campaign, a defender who captured the key could decrypt files for all victims from that deployment wave. This was the flaw that allowed the Trustwave decryptor to work.
Encryptor (v2, 2022+): The updated version addressed the key reuse problem with per-victim encryption key generation. The encryptor also added the BYOVD technique that became the group’s signature defensive evasion method.
BYOVD via RTCore64.sys: BlackByte adopted Bring Your Own Vulnerable Driver as a primary EDR evasion technique. The group deployed a legitimate but vulnerable version of the MSI Afterburner driver (RTCore64.sys), exploited its kernel read/write vulnerability (CVE-2019-16098), and used kernel-level access to disable security product processes and tamper with EDR kernel callbacks. This technique allows the group to operate in environments with endpoint detection deployed, because the defensive telemetry is disabled before the ransomware runs.
The RTCore64.sys BYOVD technique was documented by Sophos researchers in late 2022. Its adoption by BlackByte reflected the broader trend of financially motivated groups incorporating kernel exploitation techniques previously associated with nation-state actors.
Encryption scope: BlackByte targets local drives, network shares, and connected removable storage. The encryptor terminates specific processes — database services, backup agents, shadow copy services — before beginning encryption to prevent file locking. VSS shadow copies are deleted to prevent recovery without backup systems.
Linux/ESXi variant: A Go-based BlackByte variant targeting Linux and VMware ESXi hypervisors has been observed. The Linux variant follows the same double-extortion model and targets the VMs running on ESXi, encrypting VMDK disk image files and rendering hosted virtual machines unrecoverable without a decryption key.
Data exfiltration: BlackByte exfiltrates data before encryption using tools including WinSCP and custom exfiltration utilities. The exfiltrated data constitutes the leverage for double extortion — paying the decryption ransom does not guarantee the data won’t be published.
Notable Incidents
San Francisco 49ers (February 2022)
BlackByte’s highest-profile confirmed victim remains the San Francisco 49ers NFL franchise, breached in February 2022 in the days before Super Bowl LVI. The group published financial data from the organisation on its Tor leak site. The attack affected corporate IT systems; the 49ers stated that stadium and game-day operations were not impacted.
The timing — one of the highest-profile sporting events in the US — drew significant media coverage and underlined that the group was not limiting itself to targets where the public profile was low.
Critical Infrastructure (Ongoing)
CISA’s 2022 advisory documented attacks on critical infrastructure entities without naming victims. The pattern of targeting essential services — financial institutions, government contractors, food distribution companies, transportation operators — has continued through 2023 and 2024.
Post-2023 Activity
BlackByte activity moderated in late 2022 and 2023, with lower victim counts on the leak site compared to peak activity. Whether this reflects law enforcement pressure, retooling, or operational restructuring is not confirmed. Samples attributed to BlackByte continued to surface, maintaining the BYOVD EDR evasion technique and the Go-based ESXi capability.
In 2024 and 2025, researchers observed BlackByte activity involving exploitation of VMware ESXi hypervisors through known vulnerabilities, consistent with the group’s pattern of targeting high-value virtualisation infrastructure. The victim profile remained consistent: mid-to-large enterprises in critical sectors where operational disruption has high leverage.
TTPs Summary
| Category | Detail |
|---|---|
| Initial Access | Exploitation of internet-facing vulnerabilities (VPN, RDP, Exchange); phishing |
| Execution | PowerShell, scheduled tasks |
| Defence Evasion | BYOVD via RTCore64.sys (CVE-2019-16098); process termination of AV/EDR |
| Credential Access | LSASS memory dump; credential harvesting tools |
| Lateral Movement | SMB; RDP; legitimate remote access tools |
| Exfiltration | WinSCP; custom utilities; cloud storage staging |
| Impact | File encryption (AES); shadow copy deletion; network share encryption; ESXi VM encryption |
Recommended Defensive Priorities
Organisations in BlackByte’s target sectors should focus on:
BYOVD prevention. Microsoft’s Vulnerable Driver Blocklist (DriverSiPolicy.p7b) includes RTCore64.sys and should be enforced via WDAC or Memory Integrity (HVCI). Ensure Windows Defender Application Control policies block known vulnerable drivers before they can be loaded.
ESXi patching. BlackByte’s Go-based variant exploits ESXi vulnerabilities. ESXi hosts should be patched promptly and should not have management interfaces exposed to corporate networks without strict access controls.
VSS protection. Shadow copy deletion is a precursor to successful encryption. Monitoring for vssadmin delete shadows, wmic shadowcopy delete, or equivalent commands provides early warning. Consider enabling Protected Users group for backup service accounts.
EDR kernel telemetry. BYOVD disables EDR kernel callbacks — monitoring for kernel driver loads and kernel callback modification at the platform level (where supported) can detect the technique before security tools are disabled.