Loading malware…
BlackSuit is a Windows ransomware family and criminal operation closely tied to Royal and the broader Conti lineage. It emerged as a new encryptor associated with the Royal gang and is widely assessed as either a Royal rebrand, a parallel locker used by the same operators, or a direct successor within the same ecosystem. Reporting consistently places BlackSuit alongside former Conti and Royal personnel, and some tracking describes it as a Conti spinoff or descendant.
BlackSuit is used in enterprise-targeted intrusions that combine data theft and file encryption for extortion. Observed tradecraft includes credential theft, lateral movement with PsExec and Remote Desktop, abuse of legitimate administrative tools, and pre-encryption disruption of defenses through endpoint-security killing tools and malicious drivers. Operators linked to BlackSuit have also been associated with remote-access tooling, network reconnaissance, and exfiltration prior to encryption. Like Royal, BlackSuit has been observed deleting shadow copies to inhibit recovery.
Initial access associated with the broader BlackSuit/Royal activity includes phishing-derived access chains, compromised remote services, brute-forced RDP, exploitation of public-facing applications, and social-engineering operations in which victims are bombarded with email and then contacted by impersonated help-desk personnel over Microsoft Teams or voice calls to persuade them to install remote-access software. BlackSuit-related intrusions have also been linked to clustered ransomware tradecraft shared with other major families, suggesting affiliate crossover, tool sharing, or operational collaboration across the ransomware ecosystem.
BlackSuit has affected organizations across multiple sectors and has been prominent enough to appear regularly in incident-response and ransomware-prevalence reporting. Its operational profile reflects a mature big-game ransomware model focused on full-network compromise, data exfiltration, and high-impact extortion against enterprise victims.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Rapid7 disclosed that the initial infiltration strategy used by BlackBasta after the February 2025 internal chat leak was identified in the BlackSuit ransomware group: email bombing followed by impersonating helpdesk staff and contacting them via Microsoft Teams and voice calls to trick them into installing remote access tools such as Quick Assist, AnyDesk, and ScreenConnect.
A threat actor group that Microsoft designated as DEV-0569 (now Storm-0569) used a very similar technique in late 2022 to deploy Royal ransomware.
A threat actor group that Microsoft designated as DEV-0569 (now Storm-0569) used a very similar technique in late 2022 to deploy Royal ransomware.
"Royal ransomware is following in the same path, a new variant targeting Linux systems emerged... Royal’s Linux counterpart also targets ESXi servers"; "In its early campaigns, Royal deployed BlackCat’s encryptor, but later shifted to its own called Zeon".
“…BlackSuit ransomware actors breached CDK Global… strongly suggesting it is rebranding of Royal ransomware.”
17 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
Multiple entries describe enumerating local, logical, or physical drives and disk/volume information, e.g., 'can enumerate local drives,' 'GetLogicalDrives,' 'fsutil fsinfo drives,' 'list drives,' and 'discover logical drive information including the drive type, free space, and volume information.'
Trickbot is a cybercriminal group that has conducted ransomware campaigns across essential services including healthcare and banking.
Akira will delete system volume shadow copies via PowerShell commands. Avaddon deletes backups and shadow copies using native system tools. Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet. BlackCat can delete shadow copies using vssadmin.exe delete shadows /all /quiet and wmic.exe Shadowcopy Delete; it can also modify the boot loader using bcdedit /set {default} recoveryenabled No.
He analyzed stolen data and used sensitive information to intensify extortion tactics. When the ransom demand was not met, he allegedly encouraged co-conspirators to leak or sell the data. Court documents reveal he distributed a bulk set of sensitive records to hundreds of patients, aiming to amplify fear and force compliance.
file1.bat : a batch file designed to set up the system with autologon as the newly-created administrative user AdminBac, reboot into Safe Mode ... file2.bat : a second batch file, executed in Safe Mode via a registry key, designed to unpack the ransomware binary from the encrypted archive
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
99 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware family mentioned as one of the strains transacting with Stern.
Blacksuit4
Ransomware family mentioned as one of multiple families using PsExec and NirSoft in campaigns.
Ransomware family referenced as part of CoinEx's traced high-risk exposure, with USD 2.4 million tied to BlackSuit ransomware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.