Pierluigi Paganini August 08, 2024

FBI and CISA published a joint advisory on the BlackSuit Ransomware group, the document provides TTPs and IOCs as recently as July 2024.

CISA, in collaboration with the FBI, has published a joint advisory on the BlackSuit Ransomware group. The advisory includes recent and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) related to BlackSuit operation, which rebrands legacy Royal ransomware, identified by FBI investigations as recent as July 2024. The BlackSuit ransomware has targeted various critical infrastructure sectors, including commercial facilities, healthcare, government, and manufacturing. The report is part of the #StopRansomware initiative conducted by the US Government, the advisory, originally published on March 2, 2023, has been updated twice:

• November 13, 2023: The advisory was updated to share new Royal TTPs and IOCs.
• August 7, 2024: The advisory was updated to notify network defenders of the rebrand of “Royal” ransomware actors to “BlackSuit.” The update includes new TTPs, IOCs, and detection methods related to BlackSuit ransomware. “Royal” was updated to “BlackSuit” throughout unless referring to legacy Royal activity. Updates and new content are noted.

The BlackSuit actors gain initial access to victim networks through several methods, including Phishing campaigns, Remote Desktop Protocol (RDP) (Used in about 13.3% of incidents), exploiting vulnerabilities in public-facing applications and using initial access provided by access brokers and harvesting VPN credentials from stealer logs.

Historically, Royal actors were observed leveraging Chisel, Secure Shell (SSH) client, PuTTY, OpenSSH, and MobaXterm for C2 communications.

The group uses SharpShares and SoftPerfect NetWorx to map out victim networks. They threat actors also use Mimikatz and Nirsoft tools to steal credentials and harvest passwords. Additionally, they often deploy tools like PowerTool and GMER to terminate system processes.

The group exfiltrates data stolen from victim networks using post-exploitation tools, such as Cobalt Strike, and malware such as Ursnif.

BlackSuit actors typically demand ransoms ranging from $1 million to $10 million USD, with payments in Bitcoin, and have collectively sought over $500 million USD, with the highest individual demand reaching $60 million. They are open to negotiating payment amounts, which are not specified in the initial ransom note but are discussed via a .onion URL provided after encryption. Recently, there has been an increase in direct communications, such as phone calls or emails, from BlackSuit actors. Like other groups, the gang uses a Tor leak site to publish victim data if the ransom is not paid.

“FBI and CISA encourage organizations to implement the recommendations found in the Mitigations section of this CSA to reduce the likelihood and impact of ransomware incidents.” concludes the report that also provides Indicators of Compromise (IoCs).

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)