Loading story…
A major global equipment manufacturer suffered a severe ransomware attack orchestrated by the BlackSuit ransomware group, also known as Ignoble Scorpius. The attack began with a vishing (voice phishing) campaign in which an attacker impersonated the company's IT help desk and convinced an employee to enter their VPN credentials into a phishing site. Using these stolen credentials, the attackers gained initial access to the corporate network. Once inside, they escalated privileges by executing a DCSync attack on a domain controller, allowing them to steal highly privileged credentials, including those of a key service account. The attackers then moved laterally across the network using Remote Desktop Protocol (RDP), Server Message Block (SMB), and tools such as Advanced IP Scanner and SMBExec to map the environment and identify valuable assets. Persistence was established by deploying AnyDesk and a custom remote access trojan (RAT) as scheduled tasks on domain controllers. The threat actors compromised a second domain controller and extracted the NTDS.dit database, which contains all user password hashes, enabling further credential compromise. Over 400 GB of sensitive data was exfiltrated using a renamed rclone utility. To erase forensic evidence and hinder incident response, the attackers deployed CCleaner before launching the ransomware payload. The BlackSuit ransomware was deployed using Ansible, resulting in the simultaneous encryption of hundreds of virtual machines across nearly 60 VMware ESXi hosts, causing widespread operational disruption. The attackers demanded a $20 million ransom, which the organization refused to pay. In response, the manufacturer implemented several security measures, including upgrading to newer Cisco Adaptive Security Appliance firewalls, enforcing multi-factor authentication, segmenting the network, deactivating NTLM, and restricting administrative access to isolated VLANs. The incident highlights the significant risks posed by social engineering and credential theft, as well as the sophisticated tactics used by modern ransomware groups. The attack demonstrates the importance of robust incident response, credential hygiene, and layered security controls to mitigate the impact of such breaches. The use of legitimate remote access tools and living-off-the-land techniques by the attackers complicated detection and response efforts. The exfiltration of large volumes of sensitive data prior to encryption underscores the dual extortion tactics now common among ransomware operators. The manufacturer’s refusal to pay the ransom and rapid implementation of enhanced security controls serve as a case study in post-incident resilience. The attack also illustrates the growing trend of targeting virtualization infrastructure, such as VMware ESXi hosts, to maximize operational disruption. Security researchers and incident responders continue to analyze the tactics, techniques, and procedures (TTPs) used in this attack to inform defensive strategies for other organizations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
SC Media reported that hacked VPN credentials facilitated the disruptive BlackSuit ransomware intrusion, echoing the key access vector and impact described in the earlier technical analysis. This is a reporting development rather than a new attack event.
Palo Alto Networks Unit 42 released a public write-up detailing the anatomy of the BlackSuit attack against the global equipment manufacturer, providing technical analysis of how the incident unfolded.
After gaining access, the threat actors carried out a disruptive ransomware attack attributed to BlackSuit against the manufacturer, escalating from unauthorized access to operational impact. The reporting indicates a full intrusion sequence rather than a separate unrelated event.
Attackers obtained access to a global equipment manufacturer’s network using stolen or hacked VPN credentials, establishing the initial foothold for the intrusion described in the BlackSuit incident. The exact intrusion date is not specified in the references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators have begun leveraging Velociraptor, an open-source digital forensics and incident response (DFIR) tool, to facilitate and enhance their attacks on enterprise environments. Cisco Talos confirmed that Velociraptor, previously not definitively linked to ransomware campaigns, was used by threat actors believed to be associated with Storm-2603 and possibly a China-based group. These actors targeted VMware ESXi virtual machines and Windows servers, deploying multiple ransomware strains including Warlock, LockBit, and Babuk, which resulted in significant disruption to the victim's IT infrastructure. The attackers installed an outdated version of Velociraptor (0.73.4.0) that contained a privilege escalation vulnerability (CVE-2025-6264), enabling them to execute arbitrary commands and potentially take over endpoints. Velociraptor was used to maintain stealthy, persistent access, allowing the attackers to operate undetected while preparing and executing the ransomware payloads. In addition to Velociraptor, the attackers utilized the Windows msiexec utility to download and install tools from a Cloudflare Workers domain, including Visual Studio Code and the Radmin remote administration tool, further expanding their control and tunneling capabilities. Visual Studio Code was installed as a service and configured to create a tunnel to an attacker-controlled command-and-control (C2) server, with logs redirected for monitoring. The attackers also used encoded PowerShell commands to automate the download and execution of these tools. Sophos incident responders encountered the same threat actors in a separate incident, where they were able to prevent the final deployment of ransomware, but observed the same tactics, techniques, and procedures (TTPs). The use of Velociraptor in these attacks highlights a growing trend of threat actors repurposing legitimate security tools for malicious purposes, complicating detection and response efforts. The campaign demonstrates the attackers' ability to combine multiple open-source and commercial tools to achieve persistence, lateral movement, and data exfiltration. The presence of Babuk ransomware files on the victim's network marks a new development, as this strain had not previously been associated with Storm-2603. The attackers' use of multiple ransomware variants in a single campaign suggests a flexible and opportunistic approach to maximizing impact. The exploitation of a known vulnerability in Velociraptor underscores the importance of timely patching and monitoring of security tools themselves. The campaign also involved the use of Cloudflare tunneling and remote administration utilities, indicating a sophisticated approach to maintaining access and evading detection. The incident serves as a warning to organizations about the risks of outdated or misconfigured security tools being turned against them. Security teams are advised to monitor for unusual deployments of DFIR tools and to ensure all such software is kept up to date. The blending of legitimate and malicious activity in these attacks poses significant challenges for defenders, requiring enhanced vigilance and advanced detection capabilities.
Jun 29, 2026
A surge in sophisticated cyberattacks has been observed, with threat actors employing a variety of tactics to compromise organizations and individuals. Notable incidents include the use of the BYOVD (Bring Your Own Vulnerable Driver) technique to deploy DeadLock ransomware, as well as targeted campaigns leveraging phishing emails with HR-related lures to distribute Remcos RAT malware. Additionally, attackers are exploiting popular movie torrents to spread Agent Tesla via layered PowerShell scripts, and Android users in Spain are being targeted by the DroidLock ransomware, which can hijack devices and demand ransom through full-screen overlays. These campaigns demonstrate a trend toward multi-stage infection chains, abuse of legitimate tools and drivers, and the use of social engineering to increase the likelihood of successful compromise. Other significant developments include the targeting of Canadian organizations by the STAC6565/Gold Blade group using QWCrypt ransomware, and the emergence of new threat actor tactics such as disabling endpoint detection and response (EDR) systems to facilitate ransomware deployment. The threat landscape is further complicated by the activities of groups like Scattered Lapsus$ Hunters, who use social engineering and typosquatted domains to compromise Zendesk users, and the exposure of internal dynamics within ransomware groups like BlackBasta, revealing operational stress and internal mistrust. These incidents underscore the evolving nature of cyber threats, the blending of espionage and financial motives, and the increasing sophistication of both technical and social attack vectors.
Jun 29, 2026
Acronis Threat Research Unit reported active campaigns using **LockBit 5.0**, a major update to the **LockBit** ransomware-as-a-service (RaaS) operation that broadens targeting across **Windows, Linux, and VMware ESXi** in coordinated intrusions. The variant continues **double extortion** (data theft plus encryption) and is positioned for enterprise impact by enabling attackers to hit endpoints, servers, and hypervisors—where a single ESXi compromise can disrupt many virtual machines at once. Reporting also notes the group’s claimed ability to operate against **Proxmox** virtualization environments, further expanding the potential attack surface in organizations adopting alternative hypervisors. Technical analysis highlights stronger and more enterprise-focused builds, with the **Windows** payload using advanced defense-evasion and anti-analysis techniques such as packing/obfuscation, **DLL unhooking**, **process hollowing**, and **ETW (Event Tracing for Windows) patching**, alongside log-clearing to reduce forensic visibility. The **Linux/ESXi** builds are described as less reliant on packing but use extensive string encryption to hinder detection, while maintaining strong encryption routines and using randomized file extensions; Acronis-linked reporting also cites faster encryption and continuity with LockBit 4’s design. Victimology cited in coverage indicates a heavy focus on the **U.S. business sector** and a broad spread across industries (including manufacturing, healthcare, education, financial services, and government), with dozens of recent leak-site postings used to pressure victims and demonstrate ongoing operational tempo despite law-enforcement disruption efforts.
Jun 29, 2026