BlackByte ransomware gang returns with new extortion tactics

The BlackByte ransomware operation has returned with version 2.0 of their operation which introduces a new data leak site utilizing new extortion techniques borrowed from LockBit. Since their return, the BlackByte ransomware operation has been promoting a new data leak site on hacker forums and through Twitter accounts the threat actor seems to be controlling.

At the time of writing, the new data leak site only includes one victim but it now has new extortion strategies that allow victims to pay to extend the publishing of their data by 24 hours or download the data or destroy all the data. Although KELA, a cybersecurity intelligence firm has pointed out that BlackByte’s new data leak site is not correctly embedding the Bitcoin and Monero addresses that their possible customers can use to purchase or delete the data, making these new features currently broken.