Researchers from Cisco have discovered that the BlackByte ransomware group is only disclosing a small portion of its successful attacks on its leak site this year. Talos, the company’s cybersecurity department, believes the gang is creating extortion posts for only 20% to 30% of its successful attacks.
The study of the ransomware outfit’s leak site shows it posted 41 victims in 2023 but only three so far in 2024. BlackByte has been extremely active this year, but it’s unclear why the group hasn’t posted any further leaks.
BlackByte has carried out high-profile assaults on local governments in Newburgh, New York, and Augusta, Georgia, as well as organisations such as the San Francisco 49ers and Yamaha.
Researchers from Cisco Talos claimed that their involvement in a number of recent incident response investigations showed how quickly the organisation is evolving and how often it leads the way in exploiting vulnerabilities such as CVE-2024-37085, an ESXi software problem that Microsoft brought to light last month.