Pierluigi Paganini
August 08, 2024
CISA, in collaboration with the FBI, has published a joint advisory on the BlackSuit Ransomware group. The advisory includes recent and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) related to BlackSuit operation, which rebrands legacy Royal ransomware, identified by FBI investigations as recent as July 2024. The BlackSuit ransomware has targeted various critical infrastructure sectors, including commercial facilities, healthcare, government, and manufacturing. The report is part of the #StopRansomware initiative conducted by the US Government, the advisory, originally published on March 2, 2023, has been updated twice:
The BlackSuit actors gain initial access to victim networks through several methods, including Phishing campaigns, Remote Desktop Protocol (RDP) (Used in about 13.3% of incidents), exploiting vulnerabilities in public-facing applications and using initial access provided by access brokers and harvesting VPN credentials from stealer logs.
Historically, Royal actors were observed leveraging Chisel, Secure Shell (SSH) client, PuTTY, OpenSSH, and MobaXterm for C2 communications.
The group uses SharpShares and SoftPerfect NetWorx to map out victim networks. They threat actors also use Mimikatz and Nirsoft tools to steal credentials and harvest passwords. Additionally, they often deploy tools like PowerTool and GMER to terminate system processes.
The group exfiltrates data stolen from victim networks using post-exploitation tools, such as Cobalt Strike, and malware such as Ursnif.
BlackSuit actors typically demand ransoms ranging from $1 million to $10 million USD, with payments in Bitcoin, and have collectively sought over $500 million USD, with the highest individual demand reaching $60 million. They are open to negotiating payment amounts, which are not specified in the initial ransom note but are discussed via a .onion URL provided after encryption. Recently, there has been an increase in direct communications, such as phone calls or emails, from BlackSuit actors. Like other groups, the gang uses a Tor leak site to publish victim data if the ransom is not paid.
“FBI and CISA encourage organizations to implement the recommendations found in the Mitigations section of this CSA to reduce the likelihood and impact of ransomware incidents.” concludes the report that also provides Indicators of Compromise (IoCs).
Follow me on Twitter: and and Mastodon
(SecurityAffairs – hacking, ransomware)
