{
  "id": "blackbyte",
  "name": "BlackByte",
  "aliases": [
    "Hecamede"
  ],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Ransomware operation",
      "src": [
        "mitre-g1043"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2021,
      "src": [
        "mitre-g1043"
      ],
      "conf": "medium",
      "note": "At least 2021"
    },
    {
      "k": "attack_id",
      "v": "G1043",
      "src": [
        "mitre-g1043"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.",
      "src": [
        "mitre-g1043"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 48,
      "src": [
        "mitre-g1043"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "AdFind, Arp, BlackByte 2.0 Ransomware, BlackByte Ransomware, Cobalt Strike, Exbyte, Mimikatz, PsExec",
      "src": [
        "mitre-g1043"
      ],
      "conf": "high",
      "note": "8 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1043)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/blackbyte.html",
  "sources": {
    "mitre-g1043": {
      "title": "BlackByte, Group G1043",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1043/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}