Ransom Group: BlackSuit (Royal)
Who: Ransomware group
What: Uses advanced techniques and double extortion against victims
When: Last observed in August 27, 2024
Where: Group targets Healthcare, Government, Manufacturing and Financial Services in Europe and the United States.
Why: Primary motive is financial gain
Who are they?
The BlackSuit ransomware group, a rebranded evolution of the infamous Royal ransomware, has emerged as a significant global cybersecurity threat. Known for their sophisticated tactics, BlackSuit employs methods like phishing attacks, exploiting vulnerabilities in public-facing applications, and leveraging compromised Remote Desktop Protocols (RDP) to infiltrate networks. Their hallmark strategy, double extortion, involves not only encrypting critical data but also threatening to publish the stolen information if their ransom demands—ranging from $1 million to $10 million, typically paid in Bitcoin—are not met. Operating with precision, BlackSuit targets a variety of industries, from healthcare to critical infrastructure, often leveraging their own leak site to escalate pressure on victims who refuse to comply. While recent high-profile compromises are attributed to this group, specific victim details remain elusive. Keeping abreast of updates through cybersecurity platforms like CISA advisories is crucial for organizations aiming to understand and mitigate this persistent threat.
Tools, Tactics and Procedures (TTP)
BlackSuit is a highly organized and adaptable cyber criminal operation employing a diverse array of Tactics, Techniques, and Procedures (TTPs) to maximize the impact of its attacks. The group leverages multiple entry points, including phishing campaigns and exploiting public-facing vulnerabilities, to infiltrate target networks. Once inside, BlackSuit deploys advanced lateral movement techniques, persistence mechanisms, and credential harvesting tools to deepen its foothold. The group excels in evasion and exfiltration strategies, utilizing legitimate software and sophisticated malware to carry out double extortion attacks, combining encryption with data theft to pressure victims into compliance. Their comprehensive and evolving TTPs demonstrate a high level of technical expertise and strategic planning, making them a significant threat to organizations worldwide.
Initial Access: BlackSuit actors gain initial access primarily through phishing emails containing malicious PDF attachments or links, and also exploit Remote Desktop Protocol (RDP), vulnerable public-facing applications, and credentials sourced from initial access brokers or VPN logs
Persistence and Lateral Movement: The actors establish persistence by deploying legitimate remote monitoring and management tools, while lateral movement is achieved using PsExec, SMB, and valid administrative credentials; they also modify Group Policy Objects to disable antivirus software and use tools like SystemBC and Gootloader for sustained access.
Survey or on target acctions : Credential-stealing tools such as Mimikatz and utilities from Nirsoft are used for harvesting credentials, while network reconnaissance is conducted with tools like SharpShares and NetWorx to map out victim environment.
Command and Control : BlackSuit operators use legitimate tools such as Chisel and SSH to establish encrypted communication channels with their command and control servers, allowing them to manage operations stealthily.
Ransomware Execution : The ransomware employs partial encryption to evade detection and accelerate the encryption process, using batch scripts to automate file deletion, system modifications, and the disabling of recovery mechanisms.
Mitigation Measures for Ransomware
Day-to-Day Management:
Regular Patching: Ensure all software, operating systems, network devices, and IoT devices are consistently patched to address known vulnerabilities.
Safe Mode Preparedness: Configure security software to remain operational in Safe Mode, mitigating attackers’ attempts to disable defenses during system reboots.
Access Control:
Restrict Administrative Privileges: Minimize the use of administrative accounts to reduce the risk of malicious tools executing with elevated permissions.
Enforce Multi-Factor Authentication (MFA): Require MFA for all privileged accounts to add an additional layer of security against unauthorized access.
Network Segmentation: Implement segmentation for key infrastructure, user devices, and backups to isolate systems and limit exposure during an attack.
Backup and Recovery:
Offline Backups: Maintain updated offline backups of critical data and systems mitigating loss of data and speedy recovery.
Regular Testing: Periodically test backups for restoration to confirm reliability in the event of a ransomware incident.
Summary:
As cyber threats like BlackSuit ransomware continue to evolve, organizations face increasing risks from sophisticated double extortion tactics that combine data encryption with threats to leak sensitive information. BlackSuit exploits vulnerabilities in public-facing applications, phishing attacks, and compromised RDP to infiltrate networks and achieve persistence through advanced lateral movement and evasion techniques. To combat this threat, businesses must adopt proactive measures such as timely patching of vulnerabilities, continuous network monitoring, and industry standard cybersecurity hygiene practices, including employee training and multi factor authentication. By implementing these foundational strategies, organizations can strengthen their defenses and reduce the impact of ransomware attacks.
Sources
Cybersecurity and Infrastructure Security Agency. (2024). #StopRansomware: BlackSuit (Royal) Ransomware. Retrieved from https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a
Cybersecurity and Infrastructure Security Agency. (2024). #StopRansomware: BlackSuit (Royal) Ransomware (PDF). Retrieved from https://www.cisa.gov/sites/default/files/2024-09/aa23-061a-stopransomware-blacksuit-royal-ransomware_5.pdf
American Hospital Association. (2024). Agencies issue update on BlackSuit ransomware group. Retrieved from https://www.aha.org/news/headline/2024-08-08-agencies-issue-update-blacksuit-ransomware-group
U.S. Department of Health & Human Services. (2024). BlackSuit Ransomware Analyst Note (TLP Clear). Retrieved from https://www.hhs.gov/sites/default/files/blacksuit-ransomware-analyst-note-tlpclear.pdf