BlackSuit Ransomware Incident Response Analysis

This technical report presents an analysis of BlackSuit ransomware incidents investigated by Arete Advisors since May 2023. The report outlines the behavior of the ransomware, including the methods of intrusion and the tools used in attacks. It documents the ransom demands observed, with the highest reaching approximately $18 million and an average initial demand of around $2.5 million. The report also details the execution pattern of the ransomware, which requires specific command line arguments for encryption and identifies the group as BlackSuit in ransom notes. Additionally, it highlights the ransomware's ability to delete system backups and prevent recovery through various techniques. The report includes a spotlight on the BlackSuit threat actor group, noting its emergence as a significant player in the ransomware landscape and its potential connection to Royal ransomware. Security recommendations are provided to help organizations defend against this evolving threat and mitigate potential financial and reputational losses.