BlackSuit ransomware evolution of Royal with improved capabilities

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

BlackSuit, the rebranded Royal ransomware, conducts double extortion via phishing and RDP with ransom demands $1M–$10M USD.

BlackSuit is the evolution of Royal ransomware, active from September 2022 through June 2023, which rebranded and resumed operations by July 2024 with improved capabilities. The group conducts double extortion: exfiltrating data, disabling antivirus, and encrypting systems before publishing stolen data to a leak site if ransom is not paid. BlackSuit employs a unique partial encryption approach, allowing selective encryption percentages to evade detection and accelerate the attack. Initial access is primarily via phishing emails (often with malicious PDFs) and RDP compromise; the group also exploits public-facing applications and leverages initial access brokers to acquire VPN credentials. After gaining network access, BlackSuit actors use legitimate tools (Chisel, PuTTY, OpenSSH, MobaXterm, RClone, Brute Ratel) and malware (SystemBC, Gootloader, Cobalt Strike, Ursnif/Gozi, Mimikatz) to establish C2, move laterally via RDP and SMB, enumerate networks, steal credentials, and exfiltrate data. They delete volume shadow copies, modify Group Policy Objects to disable antivirus, and use batch files to orchestrate encryption and log deletion. Ransom demands range from $1M to $10M USD, with the largest reaching $60M; payment is demanded in Bitcoin through .onion URLs. Recently, direct telephonic and email contact from threat actors has increased. The group has demonstrated willingness to negotiate.

title: Volume Shadow Copy Deletion via Vssadmin, WMIC or PowerShell
description: Detects deletion of volume shadow copies via vssadmin, wmic shadowcopy
  or Win32_ShadowCopy, a common ransomware pre-encryption step (BlackSuit/Royal delete
  shadow copies before encrypting). Matches the command pattern, not a specific batch
  filename.
tags:
- attack.impact
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains|all:
    - Win32_ShadowCopy
    - Delete
  condition: 1 of selection_*
falsepositives:
- Backup or storage maintenance scripts that purge old shadow copies
- Administrators manually freeing disk space
level: high
id: b842eacc-2ce2-56dd-bbea-b9a226741b96
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

title: Mass Windows Event Log Clearing via Wevtutil in Batch Script
description: Detects wevtutil.exe clearing event logs (cl / clear-log), including
  when launched by cmd.exe running a .bat file, matching the batch-file log deletion
  used by BlackSuit operators.
tags:
- attack.defense-impairment
- attack.t1685.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_wevtutil:
    Image|endswith: \wevtutil.exe
    CommandLine|contains:
    - ' cl '
    - clear-log
  selection_bat_parent:
    ParentImage|endswith: \cmd.exe
    ParentCommandLine|contains: .bat
  condition: selection_wevtutil and selection_bat_parent
falsepositives:
- Administrators clearing logs via maintenance batch scripts
- Lab or image-preparation scripts resetting event logs
level: high
id: 6c62fe66-a46f-5b59-a660-72bd3fbc8862
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

title: Cobalt Strike and BlackSuit Named Pipe Creation
description: Detects creation of named pipes known from Cobalt Strike (hashdump, MSSE-*-server,
  WkSvcPipeMgr_*) and BlackSuit, as used for post-exploitation and lateral movement
  in this campaign.
tags:
- attack.lateral-movement
- attack.t1021.002
- attack.execution
logsource:
  category: pipe_created
  product: windows
detection:
  selection_wksvc:
    PipeName|contains: \WkSvcPipeMgr_
  selection_msse:
    PipeName|startswith: \MSSE-
    PipeName|endswith: -server
  selection_other:
    PipeName:
    - \hashdump
    - \334485
    - \461092
  condition: 1 of selection_*
falsepositives:
- Red team exercises using default Cobalt Strike profiles
- Rare legitimate software using a pipe with a coincidentally similar name
level: high
id: f6b70526-2cc4-554a-aa52-1e1a27153ea8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a