Blacksuit Ransomware

The BlackSuit ransomware is a malicious software designed to exploit and damage computer systems, often holding data hostage for ransom. Introduced in May 2023, it is a continuation or new version of the Royal ransomware operation, with the rebranding officially noted by the FBI and CISA in an advisory update on August 7, 2024. The advisory provided network defenders with new Tactics, Techniques, and Procedures (TTPs), Indicators of Compromise (IOCs), and detection methods related to the BlackSuit ransomware. The BlackSuit ransomware group, previously known as the Royal gang, has claimed responsibility for the attacks. The group's activities have caused significant disruptions across various sectors. In one instance, they targeted CDK Global, a major provider of IT and digital marketing solutions to the automotive industry, affecting their Software-as-a-Service platforms across the United States and Canada. In another attack, they claimed responsibility for a breach at Charles Darwin School, leading to the theft of sensitive student data. Moreover, the group added Young Consulting to its list of victims on its Tor leak site in May. Furthermore, the BlackSuit ransomware group is also linked to an alleged attack on Kadokawa, a Japanese media company involved in manga, anime, and video games, in June, resulting in an additional data leak. This group was previously responsible for shutting down Dallas last year before their rebranding. As such, the BlackSuit ransomware presents a serious threat to organizations across multiple industries, highlighting the need for robust cybersecurity measures and timely updates on threat intelligence.