Blacksuit Ransomware

The BlackSuit ransomware, a malicious software variant designed to encrypt and ransom victims' files, emerged in May 2023 as a direct evolution of the Royal ransomware. The group behind this threat, known as Ignoble Scorpius, was identified by Unit 42 Threat Intelligence, which also observed an increase in BlackSuit activity beginning in March 2024. This ramp-up of operations suggests a significant escalation in the group's activities. Analysis from TrendMicro and SentinelOne in 2023 revealed that BlackSuit ransomware has more command-line flags than recent samples, indicating its complexity. This ransomware has caused substantial disruptions across various sectors. Notably, it targeted CDK Global, a major provider of IT and digital marketing solutions to the automotive industry, affecting their SaaS platforms across the United States and Canada. Additionally, the BlackSuit ransomware gang claimed responsibility for an attack on Charles Darwin School, resulting in the theft of sensitive student data. These incidents highlight the broad range of targets and the potential severity of the threats posed by this malware. Furthermore, Kadokawa, a Japanese media company involved in manga, anime, and video games, experienced a data leak following an alleged BlackSuit ransomware attack in June 2024. It's important to note that the BlackSuit ransomware group is a rebrand of the Royal gang, maintaining the same modus operandi of encrypting and ransoming victim’s files. Given these developments, both the FBI and CISA have issued a joint advisory on the BlackSuit Ransomware group, urging organizations to implement robust cybersecurity measures.