BlackByte Ransomware Gang Comes Back to Life with a New Extortion Strategy

Ransomware Gang Comes Back First debuted in July 2021, this ransomware gang that engages in their own attacks and offers a RWaaS model, has come back into the limelight offering victims several extortion payment options.

First there was “pay us or we won’t decrypt your data.” Then came “pay us our we’ll publish your data.” Then came a slew of threats involving different ways to notify anyone that would care about the victim organization succumbing to a ransomware attack. Then came one payment amount if you pay within 24 hours and a second higher amount if you missed the initial deadline.

Now BlackByte – who, like their ransomware gang counterparts – are using the publish extortion game utilizing a dark web data leak site to ensure payment, but are offering some creative options for victim organizations. In sort of a backward customer service-like model, BlackByte are giving their victims a few extra options besides the “pay us or we’ll publish” ransom. According to Bleeping Computer, these include:

Extending the publishing of victim data to the data leak site by an additional 24 hours for the low cost of $5,000
An opportunity to download the data stolen (no doubt to validate they have something of value or not) for $200,000
A “promise” to destroy the data for $300,000

The first two are interesting, as $5,000 is a mere pittance and may buy an organization time to determine the right course of action – and, at the same time, BlackByte makes something for their troubles. The $200,000 option feels like an interesting gamble; if, say, BlackByte are asking for a ransom in the millions, you can choose to see if they’re bluffing or holding all the cards for a far less expensive option.

Despite the new ransom options, the disruptive nature of such attacks, mixed with the potential monetary and reputational damage these attacks can cause (on average around $4.54 million, according to IBM), is making it critical to stop these attacks before they ever start – something that includes Security Awareness Training to thwart phishing-based ransomware attacks by educating users to spot and stop malicious emails before they can be the catalyst for an organization-wide attack.

Free Ransomware Simulator Tool

Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 24 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

Here's how it works: