![](/static/58c232b4bdb316eca322af48ad6f6927/0d336/07-02-BlackSuit-AdobeStock_606980869-WEB-scaled.jpg)
Executive Summary
Since May 2023, Arete’s Incident Response (IR) team has responded to multiple BlackSuit ransomware engagements against organizations in the healthcare, financial services, manufacturing, professional services, public service, entertainment, and retail sectors. This spotlight explores the ransomware behavior observed, statistics from IR engagements, and background information on the threat actor. Finally, we discuss security recommendations to better defend against this evolving cyber threat and mitigate the risk of financial and reputational losses arising from these incidents.
Incident Response Data on BlackSuit Ransomware
The information below is based on BlackSuit incidents investigated by Arete since May 2023. Our IR and teams work together to analyze key data points during every ransomware engagement and form real-time threat actor (TA) insights.
- Arete has investigated dozens of engagements involving BlackSuit.
- We have been extremely successful in negotiating discounted ransoms with this TA.
- The highest observed ransom demand is around $18 million.
- The average initial demand is around $2.5 million.
- The average ransom payment facilitated is around $500,000.
- Commonly observed methods of intrusions include remote desktop protocol (RDP), virtual private network (VPN), and firewall vulnerabilities.
- Tools observed during the investigations include CobaltStrike, WinRAR, PUTTY, Rclone, Advanced IP Scanner, Network Scanner, Mimikatz, and GMER.
- A commonly observed ransom note filename is readme.blacksuit.txt.
- In some instances, backups were encrypted or deleted, while in others, backups were used for restoration.
Background
The information about the BlackSuit threat actor group in this section was shared in Arete’s 2024 Q1 Crimeware Report.
The most notable newcomer in Q1 was BlackSuit, the third most active group of Q1. Although Arete first observed BlackSuit ransomware operating in May 2023, it only accounted for less than a half percent of the total engagements in 2023. The group significantly increased its activity in Q1 2024, and there were more BlackSuit engagements in February 2024 alone than in all of 2023. BlackSuit operates as a private group without affiliates, targeting both Windows and Linux users and utilizing a double extortion method of stealing and encrypting sensitive data on a victim’s network.
BlackSuit: A Continuation of Royal Ransomware?
The BlackSuit ransomware payload has significant code overlap with Royal ransomware, and the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI believe BlackSuit to likely be a rebranding or spinoff variant of Royal. While BlackSuit could be using the same developer or code with slight modifications, Arete also observed language used by BlackSuit in ransom negotiations identical to previous engagements with Royal, which lends to the assessment that the group might be a rebrand or offshoot. Regardless, BlackSuit’s emergence demonstrates that although names may change, threat actors will find ways to adapt and evolve their operations.
![Screen shot of language from two separate BlackSuit ransomware TOR chats.](/static/892576c7a867c810f87b656f2db815ff/ea92b/07_02_BlackSuit_01sm.jpg)
![Screen shot of identical language from two separate ransomware Royal TOR chats.](/static/c2f5d09196bccba019f242e1e24c46c4/a2d22/07_02_BlackSuit_02-e1719964373929.jpg)
Technical Analysis
Malware analysis revealed that BlackSuit ransomware:
- Supports multiple command-line arguments.
- Encrypts files on the system and mounted shares.
- Adds the following extension to encrypted files: .blacksuit (e.g., file.docx.blacksuit).
- Creates a ransom note with the following filename: readme.blacksuit.txt.
- Self-identifies the group as BlackSuit in the ransom note.
- References a data leak site in the ransom note that, when accessed, self-identifies the group as BlackSuit.
- Kills a list of processes and services.
- Maintains a list of whitelisted files and directories to make sure it will not render the system unusable, preventing recovery when running a decryptor.
- Attempts to prevent system recovery by deleting the system’s volume shadow copies.
- Creates the following mutex during execution: WLm87eV1oNRx6P3E4Cy9.
Execution Pattern/Arguments
BlackSuit ransomware needs command line arguments to execute and encrypt files in the system. Command line arguments supported:
Command line argument | Description |
---|---|
-id [32-byte characters] | Ransomware ID |
-size | Invoked with drag and drop |
-ep | Number that represents the percentage of the file that will be encrypted |
-path [target_directory_path] | Used to specify a target directory to encrypt |
-localonly | Encrypt only the local system |
-networkonly | Encrypt only shared volumes/directory |
-aavm | Encrypt all files |
The ransomware will not execute in the system without the “–id” argument followed by a 32-character value that is unique in each engagement and present in the ransom note TOR URL. Portion of the data in the ransom note that contains the ID:
All your files will be decrypted, your data will be reset, your systems will stay in safe. Contact us through TOR browser using the link:
http://c7jpc6h2ccrdwmhofuij7kz6sr2fg2ndtbvvqy4fse23cf7m2e5hvqid[.]onion/?id=[32-characters]
Execution of ransomware to encrypt files:
blacksuit.exe -id [32-characters]
The ransomware developer coded the logic to allow configuration of the 32-character value in the command line during execution. This same victim-specific 32-character string value is then added to the ransom note URL used for negotiations. Due to this implementation in the ransomware code, threat researchers can execute the ransomware without knowing the 32-character string value, as any value of this type can be used to execute the malicious code. In analyzing Royal ransomware samples, Arete found a similarity in that any 32-character value can be supplied to execute the ransomware, and the value is also added to the ransom note TOR chat URL.
Example of how the ransom note content looks with a randomly supplied string (e.g., blacksuit.exe -id 7777777777777777777777777777777):
All your files will be decrypted, your data will be reset, your systems will stay in safe. Contact us through TOR browser using the link:
http://c7jpc6h2ccrdwmhofuij7kz6sr2fg2ndtbvvqy4fse23cf7m2e5hvqid[.]onion/?id=77777777777777777777777777777777777777
Obfuscated Files or Information: Software Packing
Most of the strings in the ransomware are encoded. The encoded strings are hardcoded and decoded at runtime. Every encoded string has its own decoding loop:
![Screen shot of BlackSuit ransomware string decoding loop that are encoded](/static/bc60e95256b14c7785bf0d61e913be65/b0781/07_02_BlackSuit_03-e1719968631407.jpg)
![Screen shot of BlackSuit ransomware string decoding loop that are encoded](/static/9bc292750afcc8dbb988baded6e33b4e/2bc2a/07_02_BlackSuit_04-e1719968661217.jpg)
Some relevant strings decoded in memory:
Global\\\WLm87eV1oNRx6P3E4Cy9 readme.blacksuit.txt \windows\ svchost.exe explorer.exe -size cmd.exe /c vssadmin delete shadows /all /quiet | -ep -path -localonly -networkonly -aavm Microsoft Enhanced RSA and AES Cryptographic Provider |
Obfuscated Files or Information: Dynamic API Resolution
To avoid static or other defensive analysis, the ransomware uses dynamic API resolution to conceal malware characteristics and functionality. The ransomware initially decrypts DLL names, then loads the APIs. Hardcoded encoded DLL names are shown below:
![Screen shot of BlackSuit ransomware encoded DLL names.](/static/6765c49b954197dcabfc2d4525fb46c1/471e5/07_02_BlackSuit_05a.jpg)
![Screen shot of BlackSuit ransomware encoded DLL names.](/static/ec1dd024ba05600f3dc886ff8be73abe/8c9d3/07_02_BlackSuit_06a.jpg)
DLL names decoded at runtime:
shell32.dll user32.dll advapi32.dll ws2_32.dll shlwapi.dll | rstrtmgr.dll ntdll.dll Crypt32.dll iphlpapi.dll |
Stop Services and Processes
Before file encryption, the ransomware terminates a list of known running processes and services to encrypt as many files as possible. BlackSuit ransomware utilizes the Windows Restart Manager to terminate any process using files other than explorer.exe or a critical process.
Sequence of Windows Restart Manager APIs used by the ransomware:
RmStartSession | Starts the Restart Manager session. |
RmRegisterResources | Registers resources, in this case the targeted filename |
RmGetList | Determine which processes or services are using the registered resource (file) |
RmShutdown | Shuts down any identified process or service using the registered resource |
RmEndSession | Closes the Restart Manager session. |
The ransomware also uses Windows native CreateToolhelp32Snapshot, Process32FirstW, and Process32NextW APIs to enumerate processes in the system.
File and Directory Exclusions
The ransomware excludes system-related files and folders, ransomware-related files, and whitelisted extensions during encryption.
Excluded file extensions:
.com .ani .scr .drv .hta .rom .bin .msc .ps1 .shs .adv .msu .prf .bat .idx .mpa .cmd .msi .mod .ocx .ics .386 .sys .rtp .wpx .msp .cab .ldf .lnk .cur .nls .hlp .key .ico .exe .icns .lock .theme .diagpkg .diagcab .nomedia .diagcfg .msstyles .themepack .blacksuit .deskthemepack
Excluded files and directories:
“msocache”, “intel”, “$recycle.bin”, “windows”, “windows.old”, “mozilla firefox”, “$WinREAgent”, “boot”, “google”, “perflogs”, “system volume information”, “appdata”, “tor browser”, “$windows.~ws”, “application data”, “$windows.~bt”, “mozilla”, “readme.blacksuit.txt”
Inhibit System Recovery
Windows operating systems contain features that can help fix corrupted system files, including shadow copies, which are backups of files created by the Volume Shadow Copy Service (VSS). By deleting shadow copies, the ransomware can prevent victims from restoring files from backups, making it more difficult for them to recover their data without paying the ransom.
With the CreateProcessW function, the ransomware deletes volume shadow copies before file encryption by executing the following command:
cmd.exe /c vssadmin delete shadows /all /quiet
Code in the ransomware showing this operation (the EAX register contains the kernel32.CreateProcessW address):
![Screen shot of BlackSuit ransomware creating a process call to delete volume shadow copies.](/static/68a67f67f12a0c33c1b2874686f95b19/8c9d3/07_02_BlackSuit_07a.jpg)
System Network Connections Discovery
BlackSuit ransomware can enumerate network-mounted shares by scanning the network interfaces.
Data Encrypted for Impact
The ransomware initially finds available drives and loads the files one by one using the Windows API FindFirstFileW and FindNextFileW. It then uses OpenSSL AES keys to encrypt the files and adds the extension .blacksuit to the encrypted file name.
![](/static/fe9e9a537169b181c61039acba827851/a0177/07_02_BlackSuit_08a.jpg)
Public key:
—–BEGIN RSA PUBLIC KEY—–
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA+O9FGkh466oxay/9u//rycLpGqFwcUSQIy0d27cnpRqq1W4De/boeoJC/HJqkr3WaEqr2JHgjSQcMimTxy8d3NLJT7M3uTVaxXD3Bck83ns5S/WhiF5tQGHtAGetGv8gXYSq/bm6HAlWBMBaOvv4of7ov7/cTAl1pwwgnaYzws4q6C9Q5zwmcU7DFcOohyVqBu/2svUlvtfMJGzYVeUJSUF6E2NMhClxddDLr32wCuoZ567uMBLQB2e5DUTkplR1OdVeyWyxhAXJSjQ5T9LpwuUHNm89nuo25slwlUx2m5a2k6wn2husXhXj+NRN/c2F3zh2qkcgs318XY8es1r3UgIBdCYMMGKsZ0DxKJZ1fq4nU93c+aP0qFBawmYhgIZq6MBYrG23LGbJPZvcC8pkyJrT51ygthCVPtpThqlthdqzqnV+7gPaf/XRwHeLkqawPhe1omd9m7gSuFwIREUe2MW1qZ7p3Nzhf8ZF4/YN7PSN1m6Ve5HS1MgnR9cbj655Jt3lqgW6rillrP+DbdrnjYo7yz2CsxSL3vKVtzcDzsbEFPkAFDyfSrYVxMYCEUJ8jHlctrNo+UiuZTT0O9dbwoGfCSrg8w+V0h8pYaiGnVwwGGkQbLgBAvz+iOOyElbZDLEPJxZ1+ipYzADufQSh8RHh/nXpWirlzQNH7oqrA0fUCAwEAAQ==
—–END RSA PUBLIC KEY—–
The ransomware encrypts files, adds the .blacksuit extension at the end of the encrypted files, and adds the following bytes at the end of the file (“??” represents variable bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 ?? 00 00 00 |
![](/static/1af48dc8a80e006b3a0095889e2b9274/23258/07_02_BlackSuit_09-e1719964771995.jpg)
![](/static/45b5279b5eb804cb1d1863d338e84e47/a215b/07_02_BlackSuit_10a.jpg)
Upon successful execution, the ransomware creates ransom notes with the file name readme.blacksuit.txt.
![](/static/366b5600aa38c1663b57e452eaa37060/ecc13/07_02_BlackSuit_11-e1719964806342.jpg)
Modify Registry
The ransomware did not perform any registry key modification.
Mutex
The mutex is the fundamental tool for managing shared resources between multiple threads or processes. Typically, ransomware uses a mutex to avoid reinfecting the victim system and causing multiple layers of encryption. The ransomware creates the following mutex value: “WLm87eV1oNRx6P3E4Cy9”.
![](/static/c2c8ad8d87b557149d37d46f1c626435/0be15/07_02_BlackSuit_12a.jpg)
Network Activity
The ransomware did not try to communicate with a remote server other than encrypting data from mounted shares.
Indicators of Compromise
Indicator | Type | Context |
---|---|---|
f1684fb118d4d8fc56653fcc49e12a659b64c4459ba037fa94f21783235cc6ba dede96fd44c0f78eb79ceb63b898874e8922efc59d8bfb9f86505b1992bc00a3 79ab73a0e9dd8eac045c00fd1bd172a7f359588901f93c83e6740157eb21e7df d96ff4b3e188f7ff96ed28c1381a6318dd76bb1fbd6ca02c6ab0236e1c7f35aa | SHA256 hash | BlackSuit ransomware |
C:\readme.blacksuit.txt | File path | BlackSuit ransom note |
.blacksuit | Extension | Encrypted files extension |
vssadmin delete shadows /all /quiet | Process | Volume Shadow Copy deletion |
WLm87eV1oNRx6P3E4Cy9 | Mutex | Mutex value object created by the BlackSuit ransomware |
Any 32-character string | Password | Command line argument needed to properly execute the ransomware. The ransomware developer doesn’t validate it |
c7jpc6h2ccrdwmhofuij7kz6sr2fg2ndtbvvqy4fse23cf7m2e5hvqid [.]onion weg7sdx54bevnvulapqu6bpzwztryeflq3s23tegbmnhkbpqz637f2yd[.]onion | URL | TA data leak site (DLS) |
Data Leak Site
The ransom note contains a data leak site (DLS) that displayed the following page, self-identifying the group as BlackSuit:
![](/static/40abfe50adab43628b3bdcc5c1fe0fdf/84da6/07_02_BlackSuit_13-e1719969162959.jpg)
![](/static/aa723c55084afc723b151760d2341a97/b0781/07_02_BlackSuit_14-e1719969175438.jpg)
Detection Mechanisms
Custom Detections and Blocking with Arete’s Arsinal
![](/static/daf26fba0eff34c01a34f5e8316609fb/ecc13/image-update-2-e1720021595151.jpg)
Yara
![](/static/7ab408631d25db78eb2830a68189690d/77866/image-update-1-e1720021568348.jpg)
Recommended Mitigations
- Utilize an endpoint detection and response (EDR) solution with the capability to halt detected processes and isolate systems on the network based on identified conditions.
- Block any known attacker C2s in the firewall.
- Implement multi-factor authentication on RDP and VPN to restrict access to critical network resources.
- Eliminate unnecessary RDP ports exposed to the internet.
- Block a high number of SMB connection attempts from one system to others in the network over a short period of time.
- Perform periodic dark web monitoring to verify if data is available for sale on the black market.
- Perform penetration tests.
- Periodically patch systems and update tools.
- Monitor connections to the network from suspicious locations.
- Monitor downloads and uploads of files to file-sharing services outside standard work hours.
- Monitor file uploads from domain controllers to the internet.
- Monitor network scans from uncommon servers (e.g., RDP server).
Organizations can find the full list of US government recommended ransomware prevention and mitigation guidance here: https://www.cisa.gov/stopransomware/ransomware-guide.
Arete provides data-driven cybersecurity solutions to transform your response to emerging cyber threats. Learn more.
Download Threat Actor Spotlight: BlackSuit Ransomware
Download Threat Actor Spotlight: BlackSuit Ransomware
![](/static/fe5f6093875f1535489a5acc8db411e0/bf6f6/Untitled-1-1-copy.jpg)