Blackbyte

Inactive

Ransomware. Uses dropper written in JavaScript to deploy a .NET payload.

147 Victims

Oct 4, 2021 First Discovered

Jul 30, 2025 Last Discovered

414 Days Inactive

0% Infostealer

0/9 Sites Online

Known Locations (9)

BlackByte BLOG

dlyo7r3n4qy5fzv4645nddjwarj7wjdd6wzckomcyc7akskkxp4glcad.onion

BlackByte BLOG

f5uzduboq4fa2xkjloprmctk7ve3dm46ff7aniis66cbekakvksxgeqd.onion

BB Auction

jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion

BB Auction

dounczge5jhw4iztnnpzp54kd4ot3tikhjsimurtcewqssgye6vvrhqd.onion

BlackByte BLOG

ce6roic2ykdjunyzazsxmjpz5wsar4pflpoqzntyww5c2eskcp7dq4yd.onion

6iaj3efye3q62xjgfxyegrufhewxew7yt4scxjd45tlfafyja6q4ctqd.onion

BlackByte BLOG

fl3xpz5bmgzxy4fmebhgsbycgnz24uosp3u4g33oiln627qq3gyw37ad.onion

File downloader

tj3ty2q5jm5au3bmd2embtjscd3qjt7nfio2o7cr6moyy5kgil5pieqd.onion

BB Auction

53d5skw4ypzku4bfq2tk2mr3xh5yqrzss25sooiubmjz67lb3gdivcad.onion

Tools Used

DefenseEvasion

Dell Client driver (BYOVD), GIGABYTE Motherboard driver (BYOVD), MSI Afterburner driver (BYOVD), Zemana Anti-Rootkit driver

DiscoveryEnum

PowerView, SoftPerfect NetScan

Offsec

Cobalt Strike, PowerShell Empire

RMM-Tools

AnyDesk

Intelligence

📄 4 Ransom Notes
View the actual ransom notes used by this group →

Victims (147)

Detailed victim list temporarily unavailable

This group has 147 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.