What is BlackSuit Ransomware?
Since late 2023, Darktrace has detected BlackSuit ransomware infiltrating multiple customer networks in the US. This ransomware has targeted a wide range of industries, including arts, entertainment, real estate, public administration, defense, and social security.
Emerging in May 2023, BlackSuit is believed to be a spinoff of Royal ransomware due to similarities in code and Conti, and most likely consists of Russian and Eastern European hackers [1]. Recorded Future reported that the ransomware had affected 95 organizations worldwide, though the actual number is likely much higher [2]. While BlackSuit does not appear to focus on any particular sector, it has targeted multiple organizations in the healthcare, education, IT, government, retail and manufacturing industries [3]. Employing double extortion tactics, BlackSuit not only encrypts files but also steals sensitive data to leverage ransom payments.
BlackSuit has demanded over USD 500 million in ransoms, with the highest individual demand reaching USD 60 million [4]. Notable targets include CDK Global, Japanese media conglomerate Kadokawa, multiple educational institutions, Octapharma Plasma, and the government of Brazil [5][6][7][8].
Darktrace’s Coverage of BlackSuit Ransomware Attack
Case 1, November 2023
The earliest attack on a Darktrace customer by BlackSuit was detected at the start of November 2023. The unusual network activity began on a weekend—a time commonly chosen by ransomware groups to increase their chances of success, as many security teams operate with reduced staff. Darktrace identified indicators of the attackers’ presence on the network for almost two weeks, during which a total of 15 devices exhibited suspicious behavior.
The attack commenced with unusual internal SMB (Server Message Block) connections using a compromised service account. An internal device uploaded an executable (zzza.exe) to a domain controller (DC) and shortly after, wrote a script (socks5.ps1) to another device. According to a Cybersecurity Advisory from the CISA (Cybersecurity and Infrastructure Security Agency, US), the script file was a PowerShell reverse proxy [9].
Approximately an hour and a half later, the device to which the script was written exhibited uncommon WMI (Windows Management Instrumentation) activity. Two hours after receiving the executable file, the DC was observed making an outgoing NTLM request, using PowerShell to remotely execute commands, distributing differently named executable files (<PART OF THE CUSTOMER’S NAME>.exe), and controlling services on other devices.
Eighteen hours after the start of the unusual activity, Darktrace detected another device making repeated connections to “mystuff.bublup[.]com”, which the aforementioned CISA Advisory identifies as a domain used by BlackSuit for data exfiltration [9].
About ten minutes after the suspicious executables were distributed across the network, and less than 24 hours after the start of the unusual activity, file encryption began. A total of ten devices were seen appending the “.blacksuit” extension to files saved on other devices using SMB, as well as writing ransom notes (readme.blacksuit.txt). The file encryption lasted less than 20 minutes.
During this compromise, external connections to endpoints related to ConnectWise’s ScreenConnect remote management tool were also seen from multiple servers, suggesting that the tool was likely being abused for command-and-control (C2) activity. Darktrace identified anomalous connectivity associated with ScreenConnect was seen up to 11 days after the start of the attack.
10 days after the start of the compromise, an account belonging to a manager was detected adding “.blacksuit” extensions to the customer’s Software-a-Service (SaaS) resources while connecting from 173.251.109[.]106. Six minutes after file encryption began, Darktrace flagged the unusual activity and recommended a block. However, since Autonomous Response mode was not enabled, the customer’s security team needed to manually confirm the action. Consequently, suspicious activity continued for about a week after the initial encryption. This included disabling authentication on the account and an unusual Teams session initiated from the suspicious external endpoint 216.151.180[.]147.
Case 2, February 2024
Another BlackSuit compromise occurred at the start of February 2024, when Darktrace identified approximately 50 devices exhibiting ransomware-related activity in another US customer’s environment. Further investigation revealed that a significant number of additional devices had also been compromised. These devices were outside Darktrace’s purview to the customer’s specific deployment configuration. The threat actors managed to exfiltrate around 4 TB of data.
Initial access to the network was gained via a virtual private network (VPN) compromise in January 2024, when suspicious connections from a Romanian IP address were detected. According to CISA, the BlackSuit group often utilizes the services of initial access brokers (IAB)—actors who specialize in infiltrating networks, such as through VPNs, and then selling that unauthorized access to other threat actors [9]. Other initial access vectors include phishing emails, RDP (Remote Desktop Protocol) compromise, and exploitation of vulnerable public-facing applications.
Similar to the first case, the file encryption began at the end of the working week. During this phase of the attack, affected devices were observed encrypting files on other internal devices using two compromised administrator accounts. The encryption activity lasted for approximately six and a half hours. Multiple alerts were sent to the customer from Darktrace’s Security Operations Centre (SOC) team, who began reviewing the activity within four minutes of the start of the file encryption.
In this case, the threat actor utilized SystemBC proxy malware for command and control (C2). A domain controller (DC) was seen connecting to 137.220.61[.]94 on the same day the file encryption took place. The DC was also observed connecting to a ProxyScrape domain around the same time, which is related to the SOCKS5 protocol used by SystemBC. During this compromise, RDP, SSH, and SMB were used for lateral movement within the network.
Signs of threat actors potentially being on the network were observed as early as two days prior to the file encryption. This included unusual internal network scanning via multiple protocols (ICMP, SMB, RDP, etc.), credential brute-forcing, SMB access failures, and anonymous SMBv1 sessions. These activities were traced to IP addresses belonging to two desktop devices in the VPN subnet associated with two regular employee user accounts. Threat actors were seemingly able to exploit at least one of these accounts due to LDAP legacy policies being in place on the customer’s environment.
Case 3, August 2024
The most recently observed BlackSuit compromise occurred in August 2024, when a device was observed attempting to brute-force the credentials of an IT administrator. This activity continued for 11 days.
Once the admin’s account was successfully compromised, network scanning, unusual WMI, and SAMR (Security Account Manager Remote protocol) activity followed. A spike in the use of this account was detected on a Sunday—once again, the attackers seemingly targeting the weekend—when the account was used by nearly 50 different devices.
The compromised admin’s account was exploited for data gathering via SMB, resulting in the movement of 200 GB of data between internal devices in preparation for exfiltration. The files were then archived using the naming convention “*.part<number>.rar”.
Around the same time, Darktrace observed data transfers from 19 internal devices to “bublup-media-production.s3.amazonaws[.]com,” totaling just over 200 GB—the same volume of data gathered internally. Connections to other Bublup domains were also detected. The internal data download and external data transfer activity took approximately 8-9 hours.
Unfortunately, Darktrace was not configured in Autonomous Response mode at the time of the attack, meaning any mitigative actions to stop the data gathering or exfiltration required human confirmation.
![One of the compromised devices was seen sending 80 GB of data to bublup-media-production.s3.amazonaws[.]com within a span of 4 hours.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/673513f1135d0e009caf256f_6735136a725738f4afe4de2b_Fig%25207.avif)
Once the information was stolen, the threat actor moved on to the final stage of the attack—file encryption. Five internal devices, using either the compromised admin account or connecting via anonymous SMBv1 sessions, were seen encrypting files and writing ransom notes to five other devices on the network. The attempts at file encryption continued for around two hours, but Darktrace’s Autonomous Response capability was able to block the activity and prevent the attack from escalating.
Conclusion
The persistent and evolving threat posed by ransomware like BlackSuit underscores the critical importance of robust cybersecurity measures across all sectors. Since its emergence in 2023, BlackSuit has demonstrated a sophisticated approach to infiltrating networks, leveraging double extortion tactics, and demanding substantial ransoms. The cases highlighted above illustrate the varied methods and persistence of BlackSuit attackers, from exploiting VPN vulnerabilities to abusing remote management tools and targeting off-hours to maximize impact.
Although many similar connection patterns, such as the abuse of Bublup services for data exfiltration or the use of SOCKS5 proxies for C2, were observed during cases investigated by Darktrace, BlackSuit actors are highly sophisticated and tailors their attacks to each target organization. The consequences of a successful attack can be highly disruptive, and remediation efforts can be time-consuming and costly. This includes taking the entire network offline while responding to the incident, restoring encrypted files from backups (if available), dealing with damage to the organization’s reputation, and potential lawsuits.
These BlackSuit ransomware incidents emphasize the need for continuous vigilance, timely updates to security protocols, and the adoption of autonomous response technologies to swiftly counteract such attacks. As ransomware tactics continue to evolve, organizations must remain agile and informed to protect their critical assets and data. By learning from these incidents and enhancing their cybersecurity frameworks, organizations can better defend against the relentless threat of ransomware and ensure the resilience of their operations in an increasingly digital world.
Credit to Signe Zaharka (Principal Cyber Analyst) and Adam Potter (Senior Cyber Analyst)
Insights from Darktrace’s First 6: Half-year threat report for 2024
Darktrace’s First 6: Half-Year Threat Report 2024 highlights the latest attack trends and key threats observed by the Darktrace Threat Research team in the first six months of 2024.
- Focuses on anomaly detection and behavioral analysis to identify threats
- Maps mitigated cases to known, publicly attributed threats for deeper context
- Offers guidance on improving security posture to defend against persistent threats
Appendices
Darktrace Model Detections
Anomalous Connection / Data Sent to Rare Domain
Anomalous Connection / High Volume of New or Uncommon Service Control
Anomalous Connection / New or Uncommon Service Control
Anomalous Connection / Rare WinRM Outgoing
Anomalous Connection / SMB Enumeration
Anomalous Connection / Suspicious Activity On High Risk Device
Anomalous Connection / Suspicious Read Write Ratio
Anomalous Connection / Suspicious Read Write Ratio and Unusual SMB
Anomalous Connection / Sustained MIME Type Conversion
Anomalous Connection / Uncommon 1 GiB Outbound
Anomalous Connection / Unusual Admin SMB Session
Anomalous File / Internal / Additional Extension Appended to SMB File
Anomalous File / Internal / Executable Uploaded to DC
Anomalous File / Internal / Unusual SMB Script Write
Anomalous Server Activity / Anomalous External Activity from Critical Network Device
Anomalous Server Activity / Outgoing from Server
Anomalous Server Activity / Rare External from Server
Anomalous Server Activity / Write to Network Accessible WebRoot
Compliance / Outgoing NTLM Request from DC
Compliance / Remote Management Tool On Server
Compliance / SMB Drive Write
Compromise / Beacon to Young Endpoint
Compromise / Beaconing Activity To External Rare
Compromise / Ransomware / Possible Ransom Note Read
Compromise / Ransomware / Possible Ransom Note Write
Compromise / Ransomware / SMB Reads then Writes with Additional Extensions
Compromise / Ransomware / Suspicious SMB Activity
Device / Anomalous RDP Followed By Multiple Model Breaches
Device / EXE Files Distributed to Multiple Devices
Device / Internet Facing Device with High Priority Alert
Device / Large Number of Model Breaches
Device / Large Number of Model Breaches from Critical Network Device
Device / Multiple Lateral Movement Model Breaches
Device / Network Scan
Device / New or Uncommon WMI Activity
Device / New or Unusual Remote Command Execution
Device / New User Agent To Internal Server
Device / SMB Lateral Movement
Device / SMB Session Brute Force (Admin)
Device / Suspicious SMB Scanning Activity
Device / Unusual LDAP Query For Domain Admins
SaaS / Access / Teams Activity from Rare Endpoint
SaaS / Resource / SaaS Resources With Additional Extensions
SaaS / Unusual Activity / Disabled Strong Authentication
SaaS / Unusual Activity / Multiple Unusual SaaS Activity Scores
SaaS / Unusual Activity / Unusual SaaS Activity Score
SaaS / Unusual Activity / Unusual Volume of SaaS Modifications
Unusual Activity / Anomalous SMB Delete Volume
Unusual Activity / Anomalous SMB Move & Write
Unusual Activity / High Volume Client Data Transfer
Unusual Activity / High Volume Server Data Transfer
Unusual Activity / Internal Data Transfer
Unusual Activity / SMB Access Failures
Unusual Activity / Sustained Anomalous SMB Activity
Unusual Activity / Unusual External Data to New Endpoint
User / New Admin Credentials on Client
User / New Admin Credentials on Server
User/ Kerberos Password Bruteforce
Autonomous Response Models
Antigena / Network / External Threat / Antigena File then New Outbound Block
Antigena / Network / External Threat / Antigena Ransomware Block
Antigena / Network / External Threat / Antigena Suspicious Activity Block
Antigena / Network / External Threat / SMB Ratio Antigena Block
Antigena / Network / Insider Threat / Antigena Internal Anomalous File Activity
Antigena / Network / Insider Threat / Antigena Internal Data Transfer Block
Antigena / Network / Insider Threat / Antigena Large Data Volume Outbound Block
Antigena / Network / Insider Threat / Antigena Network Scan Block
Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Block
Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Pattern of Life Block
Antigena / Network / Significant Anomaly / Antigena Breaches Over Time Block
Antigena / Network / Significant Anomaly / Antigena Controlled and Model Breach
Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Client Block
Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Server Block
Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block
Antigena / Network / Significant Anomaly / Antigena Significant Server Anomaly Block
Antigena / Network / Significant Anomaly / Repeated Antigena Breaches
Antigena / SaaS / Antigena Unusual Activity Block
List of Indicators of Compromise (IoCs)
IoC - Type - Description + Confidence
.blacksuit - File extension – When encrypting the files, this extension is appended to the filename – High
readme.blacksuit.txt – ransom note - A file demanding cryptocurrency payment in exchange for decrypting the victim's files and not leaking the stolen data – High
mystuff.bublup[.]com, bublup-media-production.s3.amazonaws[.]com – data exfiltration domains related to an organization and project management app that has document sharing functionality – High
137.220.61[.]94:4001 – SystemBC C2 related IP address (this tool is often used by other ransomware groups as well) - Medium
173.251.109[.]106 – IP address seen during a SaaS BlackSuit compromise (during file encryption) – Medium
216.151.180[.]147 – IP address seen during a SaaS BlackSuit compromise (during an unusual Teams session) - Medium
MITRE ATT&CK Mapping
Tactic - Technqiue
Account Manipulation - PERSISTENCE - T1098
Alarm Suppression - INHIBIT RESPONSE FUNCTION - T0878
Application Layer Protocol - COMMAND AND CONTROL - T1071
Automated Collection - COLLECTION - T1119
Block Command Message - INHIBIT RESPONSE FUNCTION - T0803
Block Reporting Message - INHIBIT RESPONSE FUNCTION - T0804
Browser Extensions - PERSISTENCE - T1176
Brute Force I/O - IMPAIR PROCESS CONTROL - T0806
Brute Force - CREDENTIAL ACCESS - T1110
Client Configurations - RECONNAISSANCE - T1592.004 - T1592
Cloud Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078.004 - T1078
Data Destruction - IMPACT - T1485
Data Destruction - INHIBIT RESPONSE FUNCTION - T0809
Data Encrypted for Impact - IMPACT - T1486
Data from Cloud Storage Object - COLLECTION - T1530
Data Staged - COLLECTION - T1074
Domain Groups - DISCOVERY - T1069.002 - T1069
Email Collection - COLLECTION - T1114
Exfiltration Over C2 Channel - EXFILTRATION - T1041
Exfiltration to Cloud Storage - EXFILTRATION - T1567.002 - T1567
Exploit Public - Facing Application - INITIAL ACCESS - T1190
Exploitation for Privilege Escalation - PRIVILEGE ESCALATION - T0890
Exploitation of Remote Services - LATERAL MOVEMENT - T1210
File and Directory Discovery - DISCOVERY - T1083
File Deletion - DEFENSE EVASION - T1070.004 - T1070
IP Addresses - RECONNAISSANCE - T1590.005 - T1590
Lateral Tool Transfer - LATERAL MOVEMENT - T1570
LLMNR/NBT - NS Poisoning and SMB Relay - CREDENTIAL ACCESS, COLLECTION - T1557.001 - T1557
Modify Alarm Settings - INHIBIT RESPONSE FUNCTION - T0838
Modify Control Logic - IMPAIR PROCESS CONTROL, INHIBIT RESPONSE FUNCTION - T0833
Modify Parameter - IMPAIR PROCESS CONTROL - T0836
Network Service Scanning - DISCOVERY - T1046
Network Share Discovery - DISCOVERY - T1135
Pass the Hash - DEFENSE EVASION, LATERAL MOVEMENT - T1550.002 - T1550
RDP Hijacking - LATERAL MOVEMENT - T1563.002 - T1563
Remote Access Software - COMMAND AND CONTROL - T1219
Remote Desktop Protocol - LATERAL MOVEMENT - T1021.001 - T1021
Remote System Discovery - DISCOVERY - T1018
Rename System Utilities - DEFENSE EVASION - T1036.003 - T1036
Scanning IP Blocks - RECONNAISSANCE - T1595.001 - T1595
Scheduled Transfer - EXFILTRATION - T1029
Service Execution - EXECUTION - T1569.002 - T1569
Service Stop - IMPACT - T1489
SMB/Windows Admin Shares - LATERAL MOVEMENT - T1021.002 - T1021
Stored Data Manipulation - IMPACT - T1565.001 - T1565
Taint Shared Content - LATERAL MOVEMENT - T1080
Valid Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078
Vulnerability Scanning - RECONNAISSANCE - T1595.002 - T1595
Web Protocols - COMMAND AND CONTROL - T1071.001 - T1071
Web Services - RESOURCE DEVELOPMENT - T1583.006 - T1583
Web Shell - PERSISTENCE - T1505.003 - T1505
Windows Management Instrumentation - EXECUTION - T1047
Windows Remote Management - LATERAL MOVEMENT - T1021.006 - T1021
References
3. https://www.sentinelone.com/anthology/blacksuit/
4. https://thehackernews.com/2024/08/fbi-and-cisa-warn-of-blacksuit.html
6. https://therecord.media/japanese-media-kadokawa-investigating-cyber
7. https://therecord.media/plasma-donation-company-cyberattack-blacksuit
9. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a
.png)
