{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/blackbyte/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["BlackByte"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":["defense-evasion","registry-modification","persistence"],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThe Windows registry setting \u0026quot;LongPathsEnabled,\u0026quot; located under the \u0026quot;FileSystem\u0026quot; control key, allows the operating system to support file paths exceeding the traditional 260-character limit (MAX_PATH). While this feature is designed for administrative convenience, threat actors frequently target this setting to facilitate evasion. By enabling this configuration, attackers can store malicious binaries, obfuscated scripts, or exfiltrated data in deep directory structures that are difficult for standard security tools and administrative utilities to access or inspect.\u003c/p\u003e\n\u003cp\u003eObserved activity from groups such as BlackByte indicates that adversaries modify this key as part of their post-exploitation and persistence strategy. Monitoring for unauthorized changes to this registry hive provides an opportunity for defenders to intercept a critical stage of an attacker's evasion and concealment process before they execute final-stage payloads.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access is established on the target Windows system via phishing or exploitation.\u003c/li\u003e\n\u003cli\u003eThe attacker gains administrative or SYSTEM-level privileges required to modify system-wide registry hives.\u003c/li\u003e\n\u003cli\u003eThe attacker locates the registry key at HKLM\\SYSTEM\\CurrentControlSet\\Control\\FileSystem\\LongPathsEnabled.\u003c/li\u003e\n\u003cli\u003eThe attacker executes a command (e.g., reg add) to set the value of LongPathsEnabled to 1.\u003c/li\u003e\n\u003cli\u003eThe attacker creates a deeply nested directory structure exceeding 260 characters in length.\u003c/li\u003e\n\u003cli\u003eThe attacker drops and executes malicious payloads within these nested directories to evade security scanning.\u003c/li\u003e\n\u003cli\u003eThe objective is achieved, such as long-term persistence or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this registry setting allows attackers to bypass security visibility by concealing malicious files in directory paths that standard tools cannot process. This increases the likelihood of long-term persistence and the successful execution of ransomware or other malicious payloads within an environment, potentially leading to total system compromise and data loss.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect any process modifying the \u0026quot;LongPathsEnabled\u0026quot; registry value.\u003c/li\u003e\n\u003cli\u003eEstablish a baseline of authorized administrative activity to reduce noise, as legitimate configuration management systems may occasionally toggle this setting.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon Event ID 13 (RegistryEvent) across all endpoints to ensure registry modifications are logged with sufficient process context.\u003c/li\u003e\n\u003cli\u003eAudit existing systems for the current state of the LongPathsEnabled key to identify unauthorized changes that may have occurred prior to rule implementation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:12:37Z","date_published":"2026-10-12T18:12:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-long-paths-enabled/","summary":"Adversaries, including the BlackByte ransomware group, modify the 'LongPathsEnabled' registry key to bypass Windows 260-character file path limitations, enabling the concealment and execution of malicious payloads.","title":"Detection of Windows Registry Modification for LongPathsEnabled","url":"https://feed.craftedsignal.io/briefs/2026-10-long-paths-enabled/"},{"_cs_actors":["BlackByte"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":["defense-evasion","registry","ransomware"],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThe EnableLinkedConnections registry setting controls whether Windows allows network connections to be shared across different logon sessions. By modifying this key (typically located at HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System) and setting it to 1, attackers can enable access to mapped network drives across both standard and administrator-level access tokens. This technique is frequently abused by post-exploitation actors, notably during BlackByte ransomware intrusions, to facilitate lateral movement and access restricted network resources that would otherwise be protected by User Account Control (UAC) filtering. Defenders should monitor for registry modifications targeting this specific path, as the setting change is rarely required for routine end-user operations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access is established through phishing or exploitation of internet-facing services.\u003c/li\u003e\n\u003cli\u003eThe attacker gains initial code execution, typically as a standard user.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the need to access network shares mapped in a different security context.\u003c/li\u003e\n\u003cli\u003eA registry modification is performed on 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLinkedConnections' using reg.exe or API calls.\u003c/li\u003e\n\u003cli\u003eThe value is set to '0x00000001' to enable linked connections.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the now-shared network connection to access sensitive shares or sensitive data.\u003c/li\u003e\n\u003cli\u003eFinal objective such as data exfiltration or encryption (ransomware) is executed.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eModification of this registry key significantly expands the attack surface by bypassing UAC restrictions on network shares. Successful exploitation allows an attacker to escalate their capability to interact with network resources without further authentication, often resulting in mass file encryption, data theft, or complete domain compromise within the targeted sector.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect unauthorized modifications to the EnableLinkedConnections registry key.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon Event ID 13 logging to capture registry modifications across all endpoints.\u003c/li\u003e\n\u003cli\u003eInvestigate any process modifying the registry key outside of approved system administration toolsets or deployment software.\u003c/li\u003e\n\u003cli\u003ePerform a retroactive hunt for '0x00000001' values written to the EnableLinkedConnections path in registry logs.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-12T18:12:28Z","date_published":"2026-10-12T18:12:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-windows-enablelinkedconnections-registry/","summary":"Detection of unauthorized modifications to the EnableLinkedConnections registry key, a technique used by BlackByte ransomware to enable cross-privilege network share access.","title":"Windows EnableLinkedConnections Registry Modification","url":"https://feed.craftedsignal.io/briefs/2026-10-windows-enablelinkedconnections-registry/"}],"language":"en","title":"CraftedSignal Threat Feed - BlackByte","version":"https://jsonfeed.org/version/1.1"}