BlackByte is a ransomware and data-extortion operation active since at least 2021. MITRE ATT&CK identifies Hecamede as an associated tracking name and documents several generations of BlackByte ransomware.
Public investigations describe attacks against North American businesses and critical infrastructure. The malware evolved from an early implementation with a common encryption key to later versions with stronger encryption. That history does not establish that every BlackByte-branded incident used the same payload or operators.
MITRE documents credential access, discovery, data staging, exfiltration and encryption in investigated activity. In 2025, Huntress analyzed Crux ransomware, whose notes claimed affiliation with BlackByte. Huntress observed compromised-account RDP access in one case and abuse of legitimate Windows processes to disable recovery before encryption.
Crux’s claimed relationship remains unvalidated by Huntress. It should not be recorded as a confirmed BlackByte alias or rebrand on that evidence alone. A leak-site listing likewise remains a claim requiring incident-specific corroboration.
Ransomware.live records a BlackByte listing naming Cityofnewburgh-ny.gov, discovered June 22, 2024. The discovery date is not the attack’s onset or the original claim’s publication date. The city has not confirmed the actor and reported no evidence of sensitive personal-information impact.
Ransomware.live records a BlackByte listing naming City of Newburgh, discovered June 22, 2024. The discovery date is not the attack’s onset or the original claim’s publication date. The city has not confirmed the actor and reported no evidence of sensitive personal-information impact.
