Summary: CISA and the FBI have issued a joint advisory on the BlackSuit Ransomware group, detailing their tactics, techniques, and procedures (TTPs) as well as indicators of compromise (IOCs). This advisory highlights the group’s targeting of critical infrastructure and their rebranding from the legacy Royal ransomware.
Threat Actor: BlackSuit Ransomware Group | BlackSuit
Victim: Various Critical Infrastructure Sectors | critical infrastructure sectors
Key Point :
- BlackSuit actors gain initial access through phishing, RDP, exploiting vulnerabilities, and harvesting VPN credentials.
- The group utilizes tools like Mimikatz and Cobalt Strike for credential theft and data exfiltration.
- Ransom demands range from $1 million to $10 million, with negotiations conducted through a .onion URL.
- Organizations are encouraged to follow the Mitigations section of the advisory to reduce ransomware risks.
CISA, in collaboration with the FBI, has published a joint advisory on the BlackSuit Ransomware group. The advisory includes recent and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) related to BlackSuit operation, which rebrands legacy Royal ransomware, identified by FBI investigations as recent as July 2024. The BlackSuit ransomware has targeted various critical infrastructure sectors, including commercial facilities, healthcare, government, and manufacturing. The report is part of the #StopRansomware initiative conducted by the US Government, the advisory, originally published on March 2, 2023, has been updated twice:
- November 13, 2023: The advisory was updated to share new Royal TTPs and IOCs.
- August 7, 2024: The advisory was updated to notify network defenders of the rebrand of “Royal” ransomware actors to “BlackSuit.” The update includes new TTPs, IOCs, and detection methods related to BlackSuit ransomware. “Royal” was updated to “BlackSuit” throughout unless referring to legacy Royal activity. Updates and new content are noted.
The BlackSuit actors gain initial access to victim networks through several methods, including Phishing campaigns, Remote Desktop Protocol (RDP) (Used in about 13.3% of incidents), exploiting vulnerabilities in public-facing applications and using initial access provided by access brokers and harvesting VPN credentials from stealer logs.
Historically, Royal actors were observed leveraging Chisel, Secure Shell (SSH) client, PuTTY, OpenSSH, and MobaXterm for C2 communications.
The group uses SharpShares and SoftPerfect NetWorx to map out victim networks. They threat actors also use Mimikatz and Nirsoft tools to steal credentials and harvest passwords. Additionally, they often deploy tools like PowerTool and GMER to terminate system processes.
The group exfiltrates data stolen from victim networks using post-exploitation tools, such as Cobalt Strike, and malware such as Ursnif.
BlackSuit actors typically demand ransoms ranging from $1 million to $10 million USD, with payments in Bitcoin, and have collectively sought over $500 million USD, with the highest individual demand reaching $60 million. They are open to negotiating payment amounts, which are not specified in the initial ransom note but are discussed via a .onion URL provided after encryption. Recently, there has been an increase in direct communications, such as phone calls or emails, from BlackSuit actors. Like other groups, the gang uses a Tor leak site to publish victim data if the ransom is not paid.
“FBI and CISA encourage organizations to implement the recommendations found in the Mitigations section of this CSA to reduce the likelihood and impact of ransomware incidents.” concludes the report that also provides Indicators of Compromise (IoCs).
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, ransomware)
Source: https://securityaffairs.com/166760/hacking/blacksuit-ransomware-group-advisory.html