BlackByte

Cybercriminal groupTrackedPending verification

Also known as: Hecamede

CyberUNK

Identification silhouette. Not drawn to scale between entries.

Fact cardConfidence · Source

System

TypeCybercriminal group

Alternative designationsHecamede

ProliferationOrigin country only

Active since2021At least 2021Med^[1]

MITRE ATT&CK IDG1043High^[1]

Capabilities

ATT&CK techniques used48ATT&CK v20.1High^[1]

Malware and toolsAdFind, Arp, BlackByte 2.0 Ransomware, BlackByte Ransomware, Cobalt Strike, Exbyte, Mimikatz, PsExec8 malware and tool entries linked in ATT&CKHigh^[1]

Attribution and activity

Attributed sponsorRansomware operationMed^[1]

TargetsBlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.Med^[1]

Notes

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.

Summary

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware.

Draft entry. Values come from the cited public sources and are awaiting editor verification.

Compare JSON

Operators

Sources

BlackByte, Group G1043, MITRE ATT&CK
Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08

Change log

2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G1043)