Loading threat actor…
BlackSuit is a financially motivated ransomware threat actor associated with the Royal ransomware lineage. The group is commonly discussed alongside Royal and has been linked in reporting to affiliate-style intrusion activity that overlaps with broader ransomware ecosystem tradecraft. Documented behavior includes abuse of legitimate remote monitoring and management platforms for covert access and persistence, use of credential theft and commodity malware during early intrusion stages, deployment of remote access trojans, and maintenance of redundant footholds to survive remediation. Reported tooling and procedures are consistent with an intrusion chain in which initial compromise is followed by persistence, post-exploitation, and monetization. BlackSuit-related activity has been noted in contexts overlapping with tactics used by ransomware affiliates, including use of trusted administrative software to evade defenses and support hands-on-keyboard operations. The actor is best characterized as part of the Royal/BlackSuit ransomware cluster and broader financially driven extortion ecosystem.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.