Close Menu

BLACKBYTE · Threat actor profile

// THREAT ACTOR

BLACKBYTE_

Dormant

BLACKBYTE is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of BLACKBYTE — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

131 Victims tracked
0 / 13 Active mirrors
2021-10-04 First listing
2025-07-29 Most recent

Victims by year

  • 2025 7
  • 2024 4
  • 2023 41
  • 2022 37
  • 2021 42

Leak site mirrors

13 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • 6iaj3efye3q62xjgfxyegrufhewxew7yt4scxjd45tlfafyja6q4ctqd.onion
  • f5uzduboq4fa2xkjloprmctk7ve3dm46ff7aniis66cbekakvksxgeqd.onion BlackByte BLOG snapshot · 2021-12-30 10:07
  • dlyo7r3n4qy5fzv4645nddjwarj7wjdd6wzckomcyc7akskkxp4glcad.onion
  • fl3xpz5bmgzxy4fmebhgsbycgnz24uosp3u4g33oiln627qq3gyw37ad.onion BlackByte BLOG snapshot · 2022-04-24 21:13
  • jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion BB Auction snapshot · 2023-10-21 00:02
  • 53d5skw4ypzku4bfq2tk2mr3xh5yqrzss25sooiubmjz67lb3gdivcad.onion BB Auction snapshot · 2025-05-17 09:02
  • a2dbso6dijaqsmut36r6y4nps4cwivmfog5bpzf6uojovce6f3gl36id.onion snapshot · 2024-12-09 18:50
  • vzzf6yg67cffqndnwg56e4psw45rup45f2mis7bwblg5fs7e5voagsqd.onion snapshot · 2024-12-09 18:50
  • inbukcc4xk67uzbgkzufdqq3q3ikhwtebqxza5zlfbtzwm2g6usxidqd.onion snapshot · 2024-12-09 18:51
  • p5quu5ujzzswxv4nxyuhgg3fjj2vy2a3zmtcowalkip2temdfadanlyd.onion snapshot · 2024-12-09 18:51
  • tj3ty2q5jm5au3bmd2embtjscd3qjt7nfio2o7cr6moyy5kgil5pieqd.onion File downloader snapshot · 2024-12-13 20:14
  • kpfj3bmo77bwpy2f5zzwj4knatueuv7t3ldlpp4tlrmv2buiziw2tdyd.onion snapshot · 2024-12-11 13:11
  • ce6roic2ykdjunyzazsxmjpz5wsar4pflpoqzntyww5c2eskcp7dq4yd.onion snapshot · 2025-07-08 17:43

Recent victims

The 50 most recent victims claimed by BLACKBYTE. Total in the index: 131.

Date listed Victim Description
2025-07-29 DARA Pharma Dara Pharmaceutical designs, develops, and manufactures packaging equi…
2025-07-29 Lee & Associates In 1979, Bill Lees vision became reality when he opened the first offi…
2025-07-18 GreenLight Biosciences Founded in 2008, GreenLight Bioscience is a pre-commercial stage synth…
2025-07-18 T2 Group We are people that value the journey towards excellence, actively seek…
2025-07-18 Ark Consultancy ARK Consultancy Limited is a leading management and technical consulta…
2025-07-18 Allstarmg Founded in 1999, Allstar Marketing Group is a Performance Marketing co…
2025-07-18 Helpsonv HELP of Southern Nevada provides assistance to families and individual…
2024-09-30 TOTVS
2024-07-17 Modernauto
2024-06-23 City of Newburgh
2024-03-14 Encina Wastewater Authority
2023-10-05 Meridian Cooperative
2023-09-18 Hoteles Xcaret
2023-09-12 Alps Alpine
2023-09-09 Kirby Risk
2023-09-08 FOCUS Business Solutions
2023-09-08 Chambersburg Area School District
2023-09-06 Smead
2023-08-24 Ontellus
2023-07-05 Avalign Technologies
2023-07-03 Brett Martin
2023-06-16 Kisco Senior Living
2023-06-16 Multistack
2023-06-15 Fiege Sp. z o.o.
2023-06-15 NEBRASKALAND
2023-06-15 The Texwipe
2023-06-15 YAMAHA CORPORATION OF AMERICA
2023-05-26 City of Augusta
2023-05-17 Magic-Aire
2023-05-12 Sterling Solutions
2023-05-04 PRESS-SERVICE Monitoring Mediów
2023-04-25 Dacotah Paper
2023-04-23 Easy Automation
2023-04-15 Esperanza Viva Jóvenes de México
2023-04-15 Gulliver International
2023-04-15 Saobacdau Technologies Group
2023-04-09 City of Collegedale
2023-04-09 Creation Baumann
2023-04-09 Crown Grinding & Machining
2023-04-09 Cementos Bio-Bio
2023-03-20 Kelly Group
2023-03-16 Etex Communications
2023-03-09 Falcon Holdings
2023-03-08 Wagner CAT
2023-02-12 Inland Group
2023-02-07 Penn Power Group
2023-01-17 ARC
2023-01-14 K2 Sports
2023-01-06 Kansas City Homes
2023-01-05 Ellison Technologies

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.