Cyber Incident Victim: BlackByte
Date:
Aug 2022
Location:
United States of America
Summary
The BlackByte ransomware gang reemerged with an updated operation, BlackByte 2.0, introducing a new Tor-based data leak site and adopting extortion tactics similar to LockBit. The group promoted the site through hacker forums and controlled Twitter accounts, offering victims payment options to delay data publication, download stolen information, or destroy it entirely, with pricing varying based on victim size. However, technical flaws in embedding cryptocurrency payment addresses rendered these features non-functional. The tactics aimed to monetize stolen data through victim payments or third-party purchases, though cybersecurity analysts noted the approach mirrored LockBit's largely symbolic strategies rather than practical extortion enhancements.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The BlackByte ransomware gang reemerged in mid-August 2022 with an updated operation branded as BlackByte 2.0, following a period of inactivity. On August 17, 2022, cybersecurity researchers observed the group promoting a new Tor-based data leak site through hacker forums and Twitter accounts under their control. This relaunch introduced extortion techniques previously pioneered by the LockBit ransomware operation, though no confirmation existed regarding changes to their core encryption software. The revamped leak site initially listed one confirmed victim organization while implementing a tiered payment system allowing victims to purchase different actions: $5,000 for a 24-hour delay in data publication, $200,000 to download stolen data, and $300,000 for complete data destruction. Pricing was indicated as variable based on victim size and revenue.
Operational flaws immediately undermined the new extortion model, as cybersecurity firm KELA identified improper implementation of cryptocurrency payment addresses on the leak site. The malfunctioning Bitcoin and Monero wallet integrations rendered all payment options non-functional at launch. Despite this technical failure, the strategy aimed to monetize stolen data through dual pressure points – enabling victims to prevent disclosure while creating a marketplace for other threat actors to potentially purchase exfiltrated information. The tactics mirrored LockBit 3.0's approach, though industry observers characterized them as more of a publicity stunt than an effective extortion mechanism given the operational deficiencies. The incident demonstrated BlackByte's attempt to revitalize their ransomware activities through imitation of successful competitors' methods while struggling with technical execution.