threat actor · Origin not attributed
BlackByte
1 CVE exploited (1 in CISA KEV) · 48 techniques · 8 software
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
The strips, in order: the CVEs it is reported to exploit by weakness class and by vendor, the techniques ATT&CK says it uses by tactic, its malware and tools, then who it targets. Each square is one record.
Open G1043 on attack.mitre.orgBlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.
Source: MITRE ATT&CK, G1043. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
- Also known as
- Hecamede
- Origin
- Not attributed
- MITRE ATT&CK
- G1043
- On record in
- ATT&CK G1043
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.