Currently viewing ATT&CK v17.1 which is the current version of ATT&CK. Learn more about the versioning system or see the live site.
  1. Home
  2. Software
  3. Exbyte

Exbyte

Exbyte is an exfiltration tool written in Go that is uniquely associated with BlackByte operations. Observed since 2022, Exbyte transfers collected files to online file sharing and hosting services.[1]

ID: S1179
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 17 December 2024
Last Modified: 09 March 2025
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1140 Deobfuscate/Decode Files or Information

Exbyte decodes and decrypts data stored in the configuration file with a key provided on the command line during execution.[2]
Enterprise T1480 Execution Guardrails

Exbyte checks for the presence of a configuration file before completing execution.[2]
Enterprise T1567 Exfiltration Over Web Service

Exbyte exfiltrates collected data to online file hosting sites such as Mega.co.nz.[1][2]
Enterprise T1083 File and Directory Discovery

Exbyte enumerates all document files on an infected machine, then creates a summary of these items including filename and directory location prior to exfiltration to cloud hosting services.[1]
Enterprise T1070 .004 Indicator Removal: File Deletion

Exbyte will self-delete if a hard-coded configuration file is not found.[2]
Enterprise T1106 Native API

Exbyte calls ShellExecuteW with the IpOperation parameter RunAs to launch explorer.exe with elevated privileges.[2]
Enterprise T1069 .001 Permission Groups Discovery: Local Groups

Exbyte checks whether the process is running with privileged local access during execution.[2]
Enterprise T1518 .001 Software Discovery: Security Software Discovery

Exbyte checks for the presence of various security software products during execution.[1]
Enterprise T1497 .001 Virtualization/Sandbox Evasion: System Checks

Exbyte performs various checks to determine if it is running in a sandboxed environment to prevent analysis.[1]

Groups That Use This Software

ID Name References
G1043 BlackByte

BlackByte used Exbyte for automated file collection and exfiltration.[1][2]

References

  1. Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.
  1. Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.