The Black Byte ransomware group is striking users all over the globe
Summary: Cisco Talos reports that the BlackByte ransomware group, which operates both for its own goals and as a ransomware-as-a-service offering, has infected victims across North America, Colombia, the Netherlands, China, Mexico and Vietnam, and remained active after the FBI's February 2022 joint advisory. Talos says the group typically gains entry through phishing or unpatched public vulnerabilities such as SonicWall VPN flaws or Microsoft Exchange's ProxyShell, then uses AnyDesk and living-off-the-land binaries for lateral movement before deploying ransomware that disables Windows Defender and reboots the machine roughly 17 hours after infection begins.
Bottom line: BlackByte's entry depends on internet-facing systems left unpatched, and Talos notes the window between a vulnerability's announcement and its weaponization by criminals is shrinking every year - so an Exchange or VPN server missing its latest patch is the stake.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026