Data by ransomware.live Windows

BlackSuit

BlackSuit is a Windows ransomware family and extortion operation closely associated with Royal and widely assessed as part of the broader Conti-derived ransomware ecosystem.

Profile source: Mallory

BlackSuit

Family profile

BlackSuit is a Windows ransomware family and extortion operation closely associated with Royal and widely assessed as part of the broader Conti-derived ransomware ecosystem. It emerged as a distinct encryptor used by operators linked to Royal, with strong technical overlap reported between the two, including similar code structure, command-line options, file exclusions, and intermittent encryption behavior. BlackSuit has been described both as a Royal rebrand candidate and as a parallel locker used by the same or closely related operators.

BlackSuit intrusions are associated with enterprise-targeting ransomware tradecraft focused on rapid expansion after initial access. Reported activity tied to the Royal/BlackSuit lineage includes spearphishing campaigns that delivered Qbot on Windows systems, followed by use of PowerShell, Cobalt Strike, stolen credentials, remote administrative shares, and legitimate Windows utilities to gain privileged domain access and move laterally. Other reporting links operators in this lineage to social-engineering-based initial access, including impersonation of IT support over Microsoft Teams and voice calls to persuade users to launch remote assistance tools. Across ransomware investigations, Royal and BlackSuit have also been associated with common post-compromise tooling such as PsExec for lateral movement and NirSoft utilities for credential theft.

The malware is used in financially motivated double-extortion operations. Operators have been observed exfiltrating data to cloud storage services before encryption, then deploying ransomware broadly across compromised Windows environments. BlackSuit activity has also been linked to attack chains in which endpoint defenses are first disabled using specialized EDR-killer tooling before ransomware execution. The broader ecosystem around BlackSuit has included abuse-resistant hosting providers and criminal support services used for infrastructure, command-and-control, and extortion operations.

Victimology is consistent with big-game hunting ransomware. Reporting has tied BlackSuit-related activity to attacks against organizations across sectors including healthcare, government, telecommunications, finance, education, manufacturing, energy, construction, and other enterprise environments, with notable concentration in North America in some observed campaigns. BlackSuit is best understood as a Conti-lineage ransomware brand operating in close relationship with Royal, using mature intrusion tradecraft, credential theft, lateral movement, data exfiltration, and defense evasion to turn initial compromise into enterprise-wide encryption and extortion.

Capabilities

Credential Theft
Defense Evasion
Exfiltration
Lateral Movement
Post Exploitation

Operational record

Indicators

YARA rules

Ransom notes

Leak sites

0 available

Credential Theft

AccountRestore
Mimikatz
NirSoft Dialupass
NirSoft IEPassView (iepv)
NirSoft MailPassView
NirSoft Netpass
NirSoft RouterPassView

Defense Evasion

Eraser
GMER
Inno Setup
PowerTool
VirtualBox

Discovery Enum

AdFind
Advanced IP Scanner
SharpHound
SharpShares
SoftPerfect NetScan

Exfiltration

7-Zip
Bublup
RClone
Temp[.]sh

LOLBAS

NTDS Utility (ntdsutil)
PowerShell
PsExec
WMIC
attrib

Networking

Chisel
Cloudflared
OpenSSH

Offsec

Brute Ratel C4
Cobalt Strike
Rubeus

RMM Tools

AnyDesk
Atera
LogMeIn
MobaXterm

Published indicators

Ip

1 total

104.244.75.168

Reported operators

Threat actors

7 named in public reporting

Storm-1811

Rapid7 disclosed that the initial infiltration strategy used by BlackBasta after the February 2025 internal chat leak was identified in the BlackSuit ransomware group: email bombing followed by impersonating helpdesk staff and contacting them via Microsoft Teams and voice calls to trick them into installing remote access tools such as Quick Assist, AnyDesk, and ScreenConnect.

Storm-0569

A threat actor group that Microsoft designated as DEV-0569 (now Storm-0569) used a very similar technique in late 2022 to deploy Royal ransomware.

DEV-0569

A threat actor group that Microsoft designated as DEV-0569 (now Storm-0569) used a very similar technique in late 2022 to deploy Royal ransomware.

Conti

"Royal ransomware is following in the same path, a new variant targeting Linux systems emerged... Royal’s Linux counterpart also targets ESXi servers"; "In its early campaigns, Royal deployed BlackCat’s encryptor, but later shifted to its own called Zeon".

blacksuite_ransomware_gang

...BlackSuite Ransomware Gang...

Black Suit

“…BlackSuit ransomware actors breached CDK Global… strongly suggesting it is rebranding of Royal ransomware.”

Stern

...Stern has transacted with addresses linked to strains like Quantum, Karakurt, Diavol, and Royal in 2022 following Conti’s demise.

MITRE ATT&CK

BlackSuit in ATT&CK

37 distinct techniques

Techniques

37 techniques

T1486 Data Encrypted for Impact T1083 File and Directory Discovery T1082 System Information Discovery T1016 System Network Configuration Discovery T1057 Process Discovery T1562.009 Safe Mode Boot T1070.004 File Deletion T1059.003 Windows Command Shell T1567 Exfiltration Over Web Service T1657 Financial Theft T1490 Inhibit System Recovery T1046 Network Service Discovery T1105 Ingress Tool Transfer T1059 Command and Scripting Interpreter T1041 Exfiltration Over C2 Channel T1120 Peripheral Device Discovery T1135 Network Share Discovery T1059.012 Hypervisor CLI T1106 Native API T1680 Local Storage Discovery T1566 Phishing T1021.002 SMB/Windows Admin Shares T1489 Service Stop T1095 Non-Application Layer Protocol T1021.001 Remote Services: Remote Desktop Protocol T1133 External Remote Services T1190 Exploit Public-Facing Application T1566.001 Phishing: Spear phishing Attachment T1566.002 Phishing: Spear phishing Link T1078 Valid Accounts T1078.002 Valid Accounts: Domain Accounts T1070.001 Indicator Removal: Clear Windows Event Logs T1119 Automated Collection T1484.001 Domain Policy Modification: Group Policy Modification T1562.001 Impair Defenses: Disable or Modify Tools T1572 Protocol Tunneling T1650 Acquire Access

Reporting

Research mentioning BlackSuit

Jul 16

Telegram shortlinks knocked offline over sanctioned VPN connection

The U.S. Treasury sanctioned First VPN Service (1VPNS), its alleged Ukrainian administrator Dmytro Rashevskyi, and Belarusian cryptor seller Yevgeniy Vladimirovich Silayev for allegedly supporting ransomware and other cybercriminal activity. Officials said 1VPNS provided anonymizing infrastructure that helped threat actors hide their identities, disguise malware, and evade detection during attacks on U.S. municipalities, hospitals, schools, businesses, and critical infrastructure providers. Treasury alleged Rashevskyi used false identities to obtain infrastructure for the service, while Silayev sold malware-obfuscation tools that made malicious code harder for defenders to detect. The sanctions, issued under Executive Order 14390 and E.O. 13694 as amended, block U.S. persons from transacting with the designated parties and mark a broader move against ransomware enablers rather than only the gangs themselves. The action was coordinated with the United Kingdom and followed a May law enforcement takedown of 1VPNS infrastructure by European agencies with FBI support. Separate reporting said blockchain tracing tied payments from ransomware groups including Anubis, Qilin, and Sinobi Group to FirstVPN, adding financial evidence that the service was used as operational infrastructure by ransomware actors.

Jul 15

Scworld

U.S. sanctions VPN provider and cryptor seller for aiding ransomware gangs | brief | SC Media

Jul 15

Gurucul Threat Research

How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist | Community Portal | Gurucul

Attackers compromised the Artlist WordPress subdomain new-blog.artlist[.]io and used it to deliver a sophisticated ClickFix malware campaign that presented visitors with a fake CAPTCHA and tricked them into running PowerShell. The injected JavaScript used an EtherHiding technique, querying a Polygon smart contract to dynamically retrieve the next-stage host auth-code-check[.]info, then downloaded a multi-stage infection chain from the attacker-controlled backend. Researchers traced the intrusion to WordPress credentials stolen from an Israeli freelance developer whose machine had been infected by an infostealer after downloading a pirated copy of Adobe Acrobat Pro DC in 2023. The payload chain reportedly used a password-protected archive, a signed StruSoft/FEM-Design updater, and DLL side-loading to decode shellcode and load a final native RAT that supported encrypted and Tor-backed C2, browser credential theft, keylogging, clipboard and screen access, hidden desktop interaction, file transfer, shell and process control, SOCKS proxying, service installation, and in-memory PE delivery.

Jul 15

Xakep