{"id":48992,"date":"2022-10-24T12:51:00","date_gmt":"2022-10-24T12:51:00","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/33966\/BlackByte-Ransomware-Slinger-Twists-The-Knife-With-Data-Stealer.html"},"modified":"2022-10-24T12:51:00","modified_gmt":"2022-10-24T12:51:00","slug":"blackbyte-ransomware-slinger-twists-the-knife-with-data-stealer","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/blackbyte-ransomware-slinger-twists-the-knife-with-data-stealer\/","title":{"rendered":"BlackByte Ransomware Slinger Twists The Knife With Data Stealer"},"content":{"rendered":"

At least one affiliate of the high-profile ransomware-as-a-service (RaaS) group BlackByte is using a custom tool to exfiltrate files from a victim’s network, a key step in the fast-growing business of double-extortion.<\/p>\n

The exfiltration tool, dubbed Exbyte, is written in Go for Windows computers, and is designed to upload files to the Mega cloud storage service, according to researchers in Symantec’s Threat Hunter Team this month.<\/p>\n

Exbyte lets the affiliate speedily grab a victim’s sensitive internal documents and stash them out of sight, yet another indication of BlackByte’s rising status<\/a> in the always-dynamic ransomware world. A victim’s network is compromised, and the intruders siphon off data using Exbyte and then lock up the network using BlackByte.<\/p>\n