defection.io

malware

BlackByte 2.0 Ransomware S1181

Type: malware
Platform: Windows
Created: 17 December 2024
Last modified: 12 May 2026

BlackByte 2.0 Ransomware is a replacement for BlackByte Ransomware. Unlike BlackByte Ransomware, BlackByte 2.0 Ransomware does not have a common key for victim decryption. BlackByte 2.0 Ransomware remains uniquely associated with BlackByte operations.[1]

Techniques51st pct

Tactics68th pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

malware

BlackByte 2.0 Ransomware S1181

Type: malware
Platform: Windows
Created: 17 December 2024
Last modified: 12 May 2026

Techniques51st pct

Tactics68th pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

BlackByte 2.0 Ransomware MITRE reference S1181

Process Injection T1055 ↗

BlackByte 2.0 Ransomware injects into a newly-created svchost.exe process prior to device encryption.2

Privilege Escalation · Stealth69 detection rules

Exploitation for Privilege Escalation T1068 ↗

BlackByte 2.0 Ransomware exploits a vulnerability in the RTCore64.sys driver (CVE-2019-16098) to enable privilege escalation and defense evasion when run as a service.3

Privilege Escalation88 detection rules

File Deletion T1070.004 ↗

BlackByte 2.0 Ransomware deletes itself following device encryption.4

Stealth30 detection rules

Timestomp T1070.006 ↗

BlackByte 2.0 Ransomware can timestomp files for defense evasion and anti-forensics purposes.5

Stealth7 detection rules

Modify Registry T1112 ↗

BlackByte 2.0 Ransomware modifies the victim Registry to allow for elevated execution.6

Persistence · Defense Impairment177 detection rules

Network Share Discovery T1135 ↗

BlackByte 2.0 Ransomware can identify network shares connected to the victim machine.7

Discovery16 detection rules

Standing S1181

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques1151st pct

51st percentile · 51% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.

Tactics768th pct

68th percentile · 68% of 825 ATT&CK software entries have this many tactics spanned or fewer.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique36medTop 17%

83rd percentile · 83% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique10medTop 9%

91st percentile · 91% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique6med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique2medTop 9%

91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 11 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 329Splunk ESCU (cumulative) · 239