Blacksuit Ransomware Updated IOCs

Published 07/24/2024

I. Targeted Entities

• Healthcare sector
• Education sector
• Government organizations
• Manufacturing industries
• Retail industries

II. Introduction

New Indicators of Compromise associated with BlackSuit ransomware have been found in recent attacks. BlackSuit is a sophisticated cyber threat known for its double-extortion tactics, encrypting and exfiltrating victims' data to demand a ransom.

III. Additional Background Information

BlackSuit ransomware emerged as a prominent threat actor in the cyber landscape in 2023. It is believed to be a direct successor to the Royal ransomware, itself a descendant of the notorious Conti ransomware group. BlackSuit shares significant code similarities with Royal, including encryption algorithms and communication methods, indicating that the operators behind BlackSuit have inherited and improved upon Royal’s techniques. An analysis by Trend Micro revealed that BlackSuit and Royal ransomware have a high degree of similarity, with 98% similarity in functions, 99.5% in blocks, and 98.9% in jumps. Additionally, BlackSuit employs command-line arguments similar to those used by Royal, though with some variations and additional options.

This technical sophistication has enabled BlackSuit to carry out multiple high-profile attacks across various sectors since its emergence. Notably, one of the most significant attacks targeted a U.S.-based healthcare provider in October 2023, resulting in severe operational disruptions. The financial losses from this attack were estimated at millions, including ransom payments and recovery and mitigation costs. In another incident, an educational institution experienced a data breach, exposing sensitive student and staff information.

Financial gain is the primary motivation behind BlackSuit attacks. The group employs double-extortion tactics, demanding a ransom not only to decrypt the data but also to prevent its public release. This strategy increases the pressure on victims to pay the ransom, highlighting the ruthlessness and effectiveness of BlackSuit’s extortion methods.

Tools Used

• Blacksuit ransomware: The main payload used for encrypting victim data.
• Bravura Optitune: Legitimate remote monitoring and management (RMM) software used for maintaining remote access.
• InfoStealer: Malware designed to steal sensitive information, including credentials and financial data.
• NetScan: SoftPerfect Network Scanner (netscan.exe), a publicly available tool used for discovering host names and network services.
• Process Explorer: A Microsoft Sysinternals tool that provides detailed information about processes running on a system, used for monitoring and debugging.
• ProcessHacker: A free tool for monitoring system resources, debugging software, and detecting malware.
• PsKill: Microsoft Sysinternals command-line tool used to terminate Windows processes on local or remote systems.
• PsSuspend: Microsoft Sysinternals command-line tool used to suspend processes on a local or remote system.
• PsExec: A Microsoft Sysinternals tool for executing processes on other systems, primarily used by attackers for lateral movement.
• >Rclone (suspected): An open-source tool that can manage content in the cloud, often abused by ransomware actors to exfiltrate data from victim machines.

These tools allow BlackSuit to conduct reconnaissance, maintain persistence, and execute their ransomware effectively. The group’s preference for leveraging legitimate software tools makes their activities harder to detect and mitigate. Understanding the tools and methods used by BlackSuit ransomware is critical to defending against its attacks.

IV. MITRE ATT&CK

• T1057 – Process Discovery
  • BlackSuit ransomware operators use tools like Process Explorer to list and monitor active processes. This allows them to identify security software, such as antivirus or endpoint detection and response (EDR) tools, which they may attempt to disable to avoid detection and ensure their attack succeeds.
• T1059 – Command and Scripting Interpreter
  • BlackSuit ransomware leverages PowerShell scripts to execute commands and payloads on compromised systems. PowerShell is a powerful scripting language built into Windows that allows the automation of administrative tasks. By using PowerShell, attackers can download additional payloads, execute them, and carry out further malicious activities without raising immediate suspicion.
• T1082 – System Information Discovery
  • BlackSuit may run commands to gather information about the system architecture, OS version, installed software, and hardware details. This information helps attackers tailor their payloads and strategies to the specific environment they target, increasing the likelihood of a successful attack.
• T1083 – File and Directory Discovery
  • BlackSuit ransomware may use commands or scripts to enumerate user directories, document folders, and network shares. This helps them identify valuable files to encrypt, maximizing the impact of their attack and increasing the likelihood that victims will pay the ransom to regain access to their data.
• T1204 – User Execution
  • BlackSuit ransomware operators may send phishing emails with malicious attachments or links. These emails are crafted to appear legitimate, often posing as invoices, delivery notifications, or urgent messages that require immediate attention. When the recipient opens the attachment or clicks the link, the ransomware executes, infecting their system.
• T1486 – Data Encrypted for Impact
  • BlackSuit encrypts critical files on the victim’s system using strong encryption algorithms. After encrypting the data, the attackers demand a ransom for the decryption key needed to restore access to the data. This not only disrupts the victim’s operations but also places them under significant pressure to pay the ransom to recover their data.
• T1490 – Inhibit System Recovery
  • BlackSuit ransomware might delete Volume Shadow Copies on Windows systems. Volume Shadow Copies are backup snapshots created by the operating system that allow users to restore their data to a previous state. By deleting these backups, the attackers ensure that victims cannot easily recover their data without paying the ransom, thereby increasing the effectiveness of their extortion.

V. Recommendations

• Hash Blacklisting and Detection Updates:
  • Maintain an up-to-date blacklist of known malicious file hashes associated with BlackSuit and other ransomware variants. Use threat intelligence feeds and security vendors’ databases to identify and block these malicious files at the network perimeter and endpoint levels. Ensure that antivirus and anti-malware solutions are configured to receive regular updates to detect new ransomware variants and their associated hashes. Promptly apply these updates to enhance your organization’s capability to detect and prevent ransomware infections.
• Regular Backup and Disaster Recovery Planning:
  • Maintain regular backups of critical data and systems, and store them securely, preferably off-site or in a cloud environment with strong encryption. Develop and periodically test a comprehensive disaster recovery plan that includes procedures for restoring data and services in a cyberattack.

• Implement Advanced Threat Intelligence and Information Sharing:
  • Subscribe to and actively monitor threat intelligence feeds for the latest information on vulnerabilities and threats. Participate in industry and government cybersecurity information-sharing programs to stay informed about emerging threats and best practices.

• Enhance Incident Response and Forensic Capabilities:
  • Develop and maintain a robust incident response plan that includes procedures for containment, eradication, and recovery. Ensure that forensic capabilities are available to investigate and understand the nature and scope of any breach, thereby improving defenses and preventing future incidents.

• Manage Default Accounts on Enterprise Assets and Software:
  • Perform periodic external penetration tests in accordance with program requirements, at least annually. External penetration testing must include enterprise and environmental reconnaissance to detect exploitable information. Penetration testing requires specialized skills and experience and must be conducted through a qualified party. The testing may be a clear box or an opaque box.

VI. IOCs (Indicators of Compromise)

VII. References

Blacksuit (2024) SentinelOne. Available at: https://www.sentinelone.com/anthology/blacksuit/ (Accessed: 08 June 2024).

Montalbano, E. (2024) BlackSuit claims dozens of victims with ransomware, BlackSuit Claims Dozens of Victims With Ransomware. Available at: https://www.darkreading.com/cyberattacks-data-breaches/blacksuit-dozens-victims-curated-ransomware (Accessed: 08 June 2024).

Contributing Security Analysts: Yousef Blassy, Thiago Pagliaroni, Yousef Aref, Abdullah Siddiqi, and Nahyan Jamil.