---
title: BlackByte 3.0 uses vulnerable drivers to compromise systems
description: BlackByte is an example of ‘ransomware-as-a-service‘ (RaaS), and the threat actors behind it constantly upgrade their malware to keep customers satisfied. Recent changes have increased the complexity of cybersecurity analytics, while also introducing new anti-analysis and anti-debugging techniques.
canonical_url: https://www.acronis.com/en/tru/posts/blackbyte-30-uses-vulnerable-drivers-to-compromise-systems/
locale: en
last_updated: 2026-10-27
---

*   [Home](https://www.acronis.com/en/tru/)
*   [Articles](https://www.acronis.com/en/tru/posts/)
*   [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)

02 October 2023

# BlackByte 3.0 uses vulnerable drivers to compromise systems

BlackByte is an example of ‘ransomware-as-a-service‘ (RaaS), and the threat actors behind it constantly upgrade their malware to keep customers satisfied. Recent changes have increased the complexity of cybersecurity analytics, while also introducing new anti-analysis and anti-debugging techniques.

Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)**

## Summary

*   Ransomware-as-a-service
*   Written in C\C++  
*   Brings vulnerable drivers for privilege escalation  
*   Uses syscalls instead of direct calls to WinAPI  
*   Injects to the ‘svchost.exe’ process  

## Introduction

The analyzed BlackByteNT (also known as BlackByte 3.0) sample was spotted in February 2023, and had been already distributed for two weeks by that time.

Being an example of ‘ransomware-as-a-service‘ (RaaS), the threat actors constantly upgrade this malware to keep their customers satisfied. BlackByte ransomware has already seen three major changes. The first version was written in C#, the second in Go, and the third (BlackByteNT) is written in C\C++. Such changes in programming languages have a certain progression in increasing the complexity of the analysis for cybersecurity analytics, also bringing new anti-analysis and anti-debugging techniques.

## Technical details

### Overview

The sample that was loaded to VirusTotal is an unpacked version of the original BlackByteNT sample, which was packed with the UPX utility. This sample is a PE64 file, written in C\C++ and designed as a console application.

![Image 1: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/0a60f9c0000d0705dd5d07be1b9c6fed.png)

### Execution

The first thing that BlackByte does is check what arguments are passed to the command line. If none of the checked-for arguments are passed, it terminates the execution.

![Image 2: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/e5b1f057e81b952d8efc193eebdd642f.png)

Assuming that one of these parameters is passed, BlackByte loads an encoded string and decodes it using XOR operation and a hardcoded key. The result will be a value, which must be passed to the command line after the given parameter. BlackByte then compares this with the value from the command line. If it differs from this value, execution is terminated.

![Image 3: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/e8f4dc55998bd414ba1b68caa9727212.png)

If it matches, execution proceeds. During analysis, we observed the following behavior with different parameters:

_-a – inject to ‘svchost.exe’, do not encrypt files_ _-w – inject ‘svchost.exe’, encrypt files_ _-s – inject ‘svchost.exe’, encrypt files_ _-q – do not inject to ‘svchost.exe’, do not encrypt files_

One additional argument can be passed after the main parameter – ‘svc’.

![Image 4: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/df09f5bce81865847c34be98b0eb1a82.png)

This will cause BlackByte to create a new thread and use the ‘StartServiceCtrlDispatcherW’ function to register a new service with a random name.

![Image 5: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/0dd90810c708856043583bf368b586a0.png)

This sample doesn’t have a lot of imports, but it decodes their names during execution.

![Image 6: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/ac36ac53d908abb1d8ac27975d8d7f29.png)

Then it stores them in local variables.

![Image 7: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/3cd9e7457c98d4fb5a2cc179a3965613.png)

BlackByte creates four new files in the ‘C:\SystemData’ folder.

![Image 8: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/55e42e6e9753f4bbaa23e88f02b57eb7.png)

These files are:

_A3V86HEL_– RTCore64.sys, a Micro-Star MSI AfterBurner kernel mode driver (CVE-2019-16098).  
_A3V86HEL\_1_– DBUtil_2_3.Sys, a Dell Client firmware update utility driver (CVE-2021-21551).  
_jxUxd.ico_– an icon.  
_MsExchangeLog1.log_ – a log file.

The first two files are drivers with vulnerabilities, which can be exploited for escalation of privileges. One of these files, ‘_RTCore64.sys,_’ has already been used in the BlackByte v2 ransomware.

During execution, BlackByte writes data to the log file, which is probably used to log the execution process.

![Image 9: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/3915b6bdd245622a1c08620081a75211.png)

Then it executes ‘svchost.exe’ with the same argument as the sample.

![Image 10: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/88ef9a751ae53737b754d40ec9d360bc.png)

After the process is created, BlackByte searches for it with the ‘CreateToolHelp32Snapshot,’ ‘Process32First,’ and ‘Process32Next’ functions for further injection.

![Image 11: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/2edcaf1ce5d2e71030cb2e0b1627d7a0.png)

The initial ransomware process deletes its original file by creating a ‘cmd.exe’ process with the ‘CreateProcessInternalW’ function, using the following command:

![Image 12: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/b498ac706b41311f11e78f168ecb0ff8.png)

Then the original process is terminated; further work will be done in the ‘svchost.exe’ process.

### File encryption

After the ‘svchost.exe’ process loads its imports, it proceeds to create new threads. It created 14 encryption threads in total, with a start address of ‘00007FF75A6DA630.’

![Image 13: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/8eeabd33c25038513c8836bbe1b6e506.png)

Throughout the execution process, BlackByteNT doesn’t call WinAPI functions directly. Instead, it uses syscalls to additionally evade endpoint detection and response (EDR) and antivirus (AV) systems, which monitor user-mode hooks.

![Image 14: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/f6c08ef7a27f3dd31e51da4848151918.png)

To encrypt users’ files, BlackByteNT uses an asymmetric Curve25519 elliptic curve cryptography algorithm and symmetric ChaCha20. Both of these algorithms are hardcoded in the sample. To generate a random 32-bytes key for each file it uses the 'CryptGenRandom()’ function.

![Image 15: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/327c66af9ce86ee90defa71ee9f678e8.png)

For each file, there will be at least two writing procedures. The first one is to encrypt data. The second one (always 41 bytes in size) adds the BlackByte data, where the first 9 bytes is ‘BLACKBYTE’ string and the other 32 bytes are a key, which is unique for each file.

![Image 16: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/87cd434005f115534aa953794ca11161.png)

### Ransom note

The ransom note ‘BB_Readme_CDXNB8WC.txt’ is dropped in each encrypted folder and opened automatically at the end of encryption. The note contains a personal URL and key to access chat with threat actors, and a link to the data auction.

![Image 17: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/c83ff84900083d5baa8a647e21f188ec.png)

### Data leak site

The auction link points to the leak site, where victims’ data is sold.

![Image 18: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/997dd6124b83eeb1760f7218afc92ba0.png)

Choosing one of the victims' tabs, we can see some screenshots of victims' files and four different buttons: pay for data, delete data (unavailable), download proof data, and buy data (unavailable).

![Image 19: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/b1a823a1a868635e0fe640deb99eea7a.png)

The proof data archive is hosted on the Anonfiles service and has 2.4 GB of stolen data, which anyone with this link can download.

![Image 20: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/fe035cbf2f8215bccd123a52f9912aed.png)

## Conclusion

As the third version of BlackByte ransomware, the ‘NT’ version continues to use vulnerable drivers to escalate privileges on the victims' machines. Aside from the programming languages, there is a difference in the encryption algorithms between these versions. The first and second versions use AES and RSA to encrypt files, and the ‘NT’ version uses Curve25519 elliptic curve cryptography algorithm and ChaCha20. As this malware operates as ransomware-as-a-service, it is possible that in the future there will be new versions of BlackByte.

## Detected by Acronis

![Image 21: BlackByte 3.0 uses vulnerable drivers to compromise systems](https://staticfiles.acronis.com/images/content/d6ae5d64a3dacc2a08632248b5c8c154.png)

## IoCs

### Files

**SHA256**

**Description**

02a0a39dbe0dcb5600f4179aeab457bb86965699e45d1d154082b02139dc701d

BlackByteNT sample

01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd

RTCore64.sys

0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5

DBUtil_2_3.Sys

### Network indicators

**URL**

http://jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion/

Related articles

[The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/)  
[Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/)  
[Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/)  
[AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)