Threat Source newsletter (May 26, 2022) — Black Byte adds itself to the grocery list of big game hunters
Summary: Cisco Talos reports that the BlackByte ransomware group, which operates both for its own goals and as a ransomware-as-a-service offering, has infected victims across North America, Colombia, the Netherlands, China, Mexico and Vietnam, and remains active after the FBI released a joint cybersecurity advisory in February 2022. The newsletter also covers Conti's ongoing attack on Costa Rica's government, which Costa Rica's president described as being "at war" with Conti, and Google researchers' finding that state-sponsored actors in Europe and the Middle East bought Cytrox's "Predator" spyware to target Android users in Egypt, Armenia, Greece, Madagascar, Côte d'Ivoire, Serbia, Spain and Indonesia.
Key Takeaway: BlackByte is still exploiting victims worldwide months after the FBI's February 2022 advisory, and Conti's attack has left many Costa Rica government services inoperable for weeks - a working example of what a big game ransomware group does to a target that does not stop it.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026