Blacksuit

BlackSuit is a new strain of malware, specifically ransomware, that has been causing significant damage to computer systems. It is believed to be a rebranding of the Royal ransomware gang, as indicated by similarities in code between the two. This suspicion was confirmed by warnings from both the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI. The rebranded BlackSuit ransomware first appeared in various reports and analyses, including those from Recorded Future, Arete Incident Response, and ReliaQuest Threat Research Team. The malicious software infiltrates systems through HTTP/S, encrypting files and leaving a ransom note for victims. Specific queries have been developed to identify the presence of this malware, looking for known names of BlackSuit's ransom notes and encrypted files. Once inside a system, BlackSuit uses Rclone, a legitimate tool often used for data exfiltration by penetration testing teams, to extract data from victim environments. Despite its legitimate uses, threat actors like BlackSuit have co-opted Rclone for nefarious purposes. In response to the rise of BlackSuit, multiple organizations, including HC3, CISA, and SafeBreach, have provided coverage and analysis of this threat. These entities aim to help businesses and individuals understand the nature of BlackSuit, how it operates, and how they can protect themselves from falling victim to this ransomware. The overall goal is to stop the spread of BlackSuit and other similar types of ransomware, protecting valuable data and maintaining the security of digital infrastructure.