Malware

BlackByte

Ransomware. Uses dropper written in JavaScript to deploy a .NET payload.

MITRE ATT&CK TTPs 15

T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1090
Proxy
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1133
External Remote Services
Persistence
 T1203
Exploitation for Client Execution
Execution
 T1212
Exploitation for Credential Access
Credential Access
 T1484.001
Group Policy Modification
Defense Evasion
 T1542.001
System Firmware
Persistence
 T1543.003
Windows Service
Persistence
 T1548.002
Bypass User Account Control
Privilege Escalation
 T1552.001
Credentials In Files
Credential Access
 T1566
Phishing
Initial Access
 T1574.002
DLL Side-Loading
Persistence
 T1588.001
Malware
Resource Development

Source Articles

IT threat evolution in Q2 2026. Non-mobile statistics
In Q2 2026, multiple ransomware groups remained active, with Qilin emerging as the most prolific based on victims listed on data leak sites. Microsoft disrupted a malware-signing-as-a-service operation run by the threat actor Fox Tempest, which was used by several ransomware groups including Rhysida, Akira, and Qilin. CISA added a Windows local privilege escalation vulnerability (CVE-2026-33825, BlueHammer) to its KEV catalog due to active exploitation in ransomware attacks. Check Point attributed zero-day exploitation of a critical vulnerability in its Remote Access VPN (CVE-2026-50751) to the Qilin ransomware group. Additionally, the PayoutsKing group was observed using QEMU to deploy hidden Alpine Linux-based virtual machines as a stealthy backdoor technique.
securelist ·8h ago