THREAT ACTOR
BLACKBYTE_
DormantBLACKBYTE is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of BLACKBYTE, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2025 7
- 2024 4
- 2023 41
- 2022 37
- 2021 42
Leak site mirrors
13 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
6iaj3efye3q62xjgfxyegrufhewxew7yt4scxjd45tlfafyja6q4ctqd.onion -
f5uzduboq4fa2xkjloprmctk7ve3dm46ff7aniis66cbekakvksxgeqd.onionBlackByte BLOG snapshot · 2021-12-30 10:07 -
dlyo7r3n4qy5fzv4645nddjwarj7wjdd6wzckomcyc7akskkxp4glcad.onion -
fl3xpz5bmgzxy4fmebhgsbycgnz24uosp3u4g33oiln627qq3gyw37ad.onionBlackByte BLOG snapshot · 2022-04-24 21:13 -
jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onionBB Auction snapshot · 2023-10-21 00:02 -
53d5skw4ypzku4bfq2tk2mr3xh5yqrzss25sooiubmjz67lb3gdivcad.onionBB Auction snapshot · 2025-05-17 09:02 -
a2dbso6dijaqsmut36r6y4nps4cwivmfog5bpzf6uojovce6f3gl36id.onionsnapshot · 2024-12-09 18:50 -
vzzf6yg67cffqndnwg56e4psw45rup45f2mis7bwblg5fs7e5voagsqd.onionsnapshot · 2024-12-09 18:50 -
inbukcc4xk67uzbgkzufdqq3q3ikhwtebqxza5zlfbtzwm2g6usxidqd.onionsnapshot · 2024-12-09 18:51 -
p5quu5ujzzswxv4nxyuhgg3fjj2vy2a3zmtcowalkip2temdfadanlyd.onionsnapshot · 2024-12-09 18:51 -
tj3ty2q5jm5au3bmd2embtjscd3qjt7nfio2o7cr6moyy5kgil5pieqd.onionFile downloader snapshot · 2024-12-13 20:14 -
kpfj3bmo77bwpy2f5zzwj4knatueuv7t3ldlpp4tlrmv2buiziw2tdyd.onionsnapshot · 2024-12-11 13:11 -
ce6roic2ykdjunyzazsxmjpz5wsar4pflpoqzntyww5c2eskcp7dq4yd.onionsnapshot · 2025-07-08 17:43
Recent victims
The 50 most recent victims claimed by BLACKBYTE. Total in the index: 131.
| Date listed | Victim | Description |
|---|---|---|
| 2025-07-29 | DARA Pharma | Dara Pharmaceutical designs, develops, and manufactures packaging equi… |
| 2025-07-29 | Lee & Associates | In 1979, Bill Lees vision became reality when he opened the first offi… |
| 2025-07-18 | GreenLight Biosciences | Founded in 2008, GreenLight Bioscience is a pre-commercial stage synth… |
| 2025-07-18 | T2 Group | We are people that value the journey towards excellence, actively seek… |
| 2025-07-18 | Ark Consultancy | ARK Consultancy Limited is a leading management and technical consulta… |
| 2025-07-18 | Allstarmg | Founded in 1999, Allstar Marketing Group is a Performance Marketing co… |
| 2025-07-18 | Helpsonv | HELP of Southern Nevada provides assistance to families and individual… |
| 2024-09-30 | TOTVS | |
| 2024-07-17 | Modernauto | |
| 2024-06-23 | City of Newburgh | |
| 2024-03-14 | Encina Wastewater Authority | |
| 2023-10-05 | Meridian Cooperative | |
| 2023-09-18 | Hoteles Xcaret | |
| 2023-09-12 | Alps Alpine | |
| 2023-09-09 | Kirby Risk | |
| 2023-09-08 | FOCUS Business Solutions | |
| 2023-09-08 | Chambersburg Area School District | |
| 2023-09-06 | Smead | |
| 2023-08-24 | Ontellus | |
| 2023-07-05 | Avalign Technologies | |
| 2023-07-03 | Brett Martin | |
| 2023-06-16 | Kisco Senior Living | |
| 2023-06-16 | Multistack | |
| 2023-06-15 | Fiege Sp. z o.o. | |
| 2023-06-15 | NEBRASKALAND | |
| 2023-06-15 | The Texwipe | |
| 2023-06-15 | YAMAHA CORPORATION OF AMERICA | |
| 2023-05-26 | City of Augusta | |
| 2023-05-17 | Magic-Aire | |
| 2023-05-12 | Sterling Solutions | |
| 2023-05-04 | PRESS-SERVICE Monitoring Mediów | |
| 2023-04-25 | Dacotah Paper | |
| 2023-04-23 | Easy Automation | |
| 2023-04-15 | Esperanza Viva Jóvenes de México | |
| 2023-04-15 | Gulliver International | |
| 2023-04-15 | Saobacdau Technologies Group | |
| 2023-04-09 | City of Collegedale | |
| 2023-04-09 | Creation Baumann | |
| 2023-04-09 | Crown Grinding & Machining | |
| 2023-04-09 | Cementos Bio-Bio | |
| 2023-03-20 | Kelly Group | |
| 2023-03-16 | Etex Communications | |
| 2023-03-09 | Falcon Holdings | |
| 2023-03-08 | Wagner CAT | |
| 2023-02-12 | Inland Group | |
| 2023-02-07 | Penn Power Group | |
| 2023-01-17 | ARC | |
| 2023-01-14 | K2 Sports | |
| 2023-01-06 | Kansas City Homes | |
| 2023-01-05 | Ellison Technologies |
CONFIRMED ATTACKS
BlackByte confirmed attacks: 32 verified incidents
Ransomnews has verified 32 BlackByte incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from October 2021 to June 2025. United States accounts for 23 of them (72%), with victims recorded in 9 countries in total. The most affected sector is government, at 10 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 2; the outcome is unrecorded in the remaining 30. Where a figure was disclosed (14 cases), these incidents account for 252,510 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified BlackByte incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| June 2025 | Towne Mortgage Company | Finance | Michigan, United States | 474 | Unknown | Source |
| July 2024 | Modern Automotive Network, LLC | Retail | North Carolina, United States | — | Unknown | Source |
| June 2024 | City of Newburgh | Government | New York, United States | — | Unknown | Source |
| February 2024 | Encina Wastewater Authority | Government | California, United States | — | Unknown | Source |
| August 2023 | Chambersburg Area School District | Education | Pennsylvania, United States | 4,265 | Unknown | Source |
| July 2023 | Alps Alpine North America, Inc. | Manufacturing | Ohio, United States | 1,039 | Unknown | Source |
| June 2023 | Kisco Senior Living | Healthcare | California, United States | 26,663 | Unknown | Source |
| May 2023 | City of Augusta | Government | Georgia, United States | — | Unknown | Source |
| April 2023 | Comisión Nacional del Agua (CONAGUA) | Government | Mexico City, Mexico | — | Unknown | Source |
| April 2023 | City of Collegedale | Government | Tennessee, United States | — | Unknown | Source |
| March 2023 | Gulliver International Co | Retail | Tokyo, Japan | — | Unknown | Source |
| January 2023 | ARC Document Solutions, Inc. | Service | California, United States | 4,888 | Unknown | Source |
| January 2023 | Penn Power Group | Service | Pennsylvania, United States | 1,960 | Unknown | Source |
| December 2022 | Community Action Partnership of Madera County | Other | California, United States | 2,643 | Unknown | Source |
| October 2022 | Altek Electronics, Inc. | Manufacturing | Connecticut, United States | — | Unknown | Source |
| October 2022 | Pitman Family Farms, Inc. | Food and Beverage | California, United States | — | Unknown | Source |
| September 2022 | Gobierno Municipal de Chihuahua | Government | Chihuahua, Mexico | — | No | Source |
| September 2022 | Northern Macedonia Ministry of Agriculture | Government | Skopje, North Macedonia | — | Unknown | Source |
| August 2022 | Apex Capital Corp. (TCS Fuel) | Finance | Texas, United States | 743 | Unknown | Source |
| June 2022 | Napa Valley College | Education | California, United States | 9,341 | Unknown | Source |
| June 2022 | Lamoille Health Partners | Healthcare | Vermont, United States | 59,381 | Unknown | Source |
| June 2022 | Gateway Rehabilitation Center | Healthcare | Pennsylvania, United States | 119,000 | Unknown | Source |
| May 2022 | La Contraloría General de la República de Perú | Government | Lima, Peru | — | Unknown | Source |
| May 2022 | ATS Insubria | Healthcare | Varese, Italy | 800 | No | Source |
| April 2022 | M+R Spedag Group | Transportation | Muttenz, Switzerland | — | Unknown | Source |
| March 2022 | NV GEBE | Utilities | Philipsburg, Sint Maarten | — | Unknown | Source |
| February 2022 | San Francisco 49ers | Other | California, United States | 20,930 | Unknown | Source |
| February 2022 | Instituto Nacional de Vigilancia de Medicamentos y Alimentos (Invima) | Government | Bogota, Colombia | — | Unknown | Source |
| October 2021 | Farmers Cooperative Elevator Co | Food and Beverage | Iowa, United States | — | Unknown | Source |
| October 2021 | Tom Lange Company, Inc. | Food and Beverage | Missouri, United States | 383 | Unknown | Source |
| October 2021 | Martin County Tax Collector’s Office | Government | Florida, United States | — | Unknown | Source |
| October 2021 | Goss Dodge, Inc. | Retail | Vermont, United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from BlackByte's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.