Threat Assessment: Black Byte Ransomware
Summary: BlackByte is a ransomware-as-a-service operation that emerged in July 2021, exploiting ProxyShell vulnerabilities for initial access and running a Tor-based auction site to sell stolen victim data under a double-extortion model. Unit 42 reports attacks on U.S. and global organizations in energy, agriculture, financial services and the public sector rose 300% in October-December 2021 versus the prior quarter, and on Feb. 13, 2022 the operators announced they had compromised the San Francisco 49ers and stolen its financial data.
Why it matters: BlackByte has cut its time-to-pay demand from 30 days to 17 and then to 12, and timed the 49ers breach around the 2022 Super Bowl - a group that compresses your decision window and picks the moment of maximum embarrassment to force payment.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·