Loading story…
A Georgia county school district was listed as a victim by the BlackSuit ransomware gang, adding to evidence that the group is actively targeting public-sector organizations. The incident was reported after the gang posted the district on its leak site, a tactic commonly used to pressure victims by threatening publication of stolen data.
The claim followed a joint CISA and FBI warning that the Royal ransomware operation may have rebranded as BlackSuit. U.S. authorities said the group uses familiar double-extortion tactics, combining file encryption with data theft, and warned organizations to harden defenses against phishing, remote access abuse, and other intrusion methods associated with the Royal/BlackSuit operators.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
BlackSuit listed a Georgia county school district on its leak site, indicating it had allegedly compromised the district and was attempting to extort it.
CISA and the FBI issued a warning that the Royal ransomware operation appeared likely to rebrand as BlackSuit, linking the newer name to the existing threat actor.
Researchers reported that the Royal ransomware gang had started testing and using a new encryptor called BlackSuit, with strong code and behavior overlap linking it to Royal. The activity suggested BlackSuit was emerging as part of Royal’s tooling months before later warnings about a possible rebrand.
Trend Micro published research assessing that BlackSuit shared similarities with Royal ransomware and may be a variant by the same authors, a copycat, or a splinter or affiliate tied to the Royal ecosystem. The report also documented BlackSuit deleting Windows shadow copies via vssadmin as part of its behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
cybernews.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI, CISA, and MS-ISAC issued a joint **#StopRansomware** advisory warning that the **Vice Society** intrusion and extortion group has disproportionately targeted the education sector, particularly **K-12 schools**. The group has caused network outages, delayed exams, canceled school days, and theft of student and staff personal information. Investigators said Vice Society has been active since at least summer 2021 and uses **double extortion**, stealing data before encrypting systems and threatening to publish it if victims refuse to pay. Authorities said Vice Society does not depend on a single ransomware strain, instead deploying variants including **Hello Kitty/Five Hands** and **Zeppelin**. The group has gained access through exploitation of internet-facing applications and compromised credentials, then moved laterally using tools such as **SystemBC**, **PowerShell Empire**, and **Cobalt Strike**, while escalating privileges through **PrintNightmare** flaws `CVE-2021-1675` and `CVE-2021-34527`. The advisory included indicators of compromise such as OnionMail addresses, a Tor leak site, command-and-control IP addresses, and file hashes, and urged organizations to prioritize patching known exploited vulnerabilities, enforce phishing-resistant MFA, maintain offline immutable backups, secure RDP, segment networks, and restrict SMB and other unnecessary ports.
Jun 29, 2026
Slate Valley Unified School District suffered a ransomware attack discovered on September 3 that compromised a district server and teachers’ personal information. The incident disrupted internet access and internal platforms for approximately a week before cybersecurity contractors helped restore connectivity. Attackers identifying themselves as the **Kairos ransomware group** demanded hundreds of thousands of dollars and threatened to leak personal information they claimed belonged to more than 1,500 employees; that claimed scope has not been independently confirmed. The FBI is investigating, and the school board said the district had made no ransom payments. District officials are notifying staff and working with outside specialists to identify affected individuals, while the Vermont Agency of Education has warned recipients not to engage with suspicious communications. Separately, TRM Labs has warned of impersonation scams in which malicious actors falsely claim affiliation with the company and offer fraudulent fund-recovery services, highlighting an additional fraud risk distinct from the school district incident.
Oct 3, 2026
A US city government suffered a ransomware-related disruption later claimed by the **Royal** ransomware group, with emergency services remaining available but computerized dispatch systems affected and some operational impacts reportedly lasting into early June. Researchers linked the incident to infrastructure and behaviors associated with Royal, a closed ransomware operation reportedly tied to former **Conti** members and known for targeting organizations through phishing, malvertising, and commodity malware. SecurityScorecard said its review of NetFlow data and VirusTotal artifacts from March through early May found activity consistent with Royal tradecraft, including a malicious HTML lure resembling **callback phishing**, communications with **QakBot**-linked IP addresses, spam-associated infrastructure, and extensive connections to **LogMeIn** remote-access services. Separate analysis of Royal ransomware has described the group’s broader tactics, techniques, and procedures, including use of initial-access malware such as **BATLOADER** and QakBot, helping place the city attack within a wider pattern of Royal intrusions and ransomware deployment.
Aug 21, 2026