BlackByte

G1043 Hecamede

▲ High Threat

Healthcare Sector Extortion Surge, Edge Infrastructure Exploitation

Origin —

Sponsor criminal organization

Motivation financial gain

Target Sectors

Healthcare Critical Infrastructure Manufacturing Education Government Services Financial Services

Ransomware-as-a-Service (RaaS)

Double Extortion

Data Exfiltration

Cobalt Strike

Exploitation of Public-Facing Applications (e.g., VPN, Citrix)

Credential Access

Lateral Movement via RDP and SMB

Living-off-the-land (LotL)

EDR Evasion

CISA Advisories ↗

Hacking the mainframe…