# BlackSuit ransomware evolution of Royal with improved capabilities

Published: 2025-07-21 · Severity: routine · Sectors: financial-services, healthcare, technology, manufacturing, energy, government-national, retail, transportation
Canonical: https://vorant.io/reports/2f961c14-a925-59c4-a67f-5e0ac57cfc10/blacksuit-ransomware-evolution-of-royal-with-improved-capabilities

> BlackSuit, the rebranded Royal ransomware, conducts double extortion via phishing and RDP with ransom demands $1M–$10M USD.

BlackSuit is the evolution of Royal ransomware, active from September 2022 through June 2023, which rebranded and resumed operations by July 2024 with improved capabilities. The group conducts double extortion: exfiltrating data, disabling antivirus, and encrypting systems before publishing stolen data to a leak site if ransom is not paid. BlackSuit employs a unique partial encryption approach, allowing selective encryption percentages to evade detection and accelerate the attack. Initial access is primarily via phishing emails (often with malicious PDFs) and RDP compromise; the group also exploits public-facing applications and leverages initial access brokers to acquire VPN credentials. After gaining network access, BlackSuit actors use legitimate tools (Chisel, PuTTY, OpenSSH, MobaXterm, RClone, Brute Ratel) and malware (SystemBC, Gootloader, Cobalt Strike, Ursnif/Gozi, Mimikatz) to establish C2, move laterally via RDP and SMB, enumerate networks, steal credentials, and exfiltrate data. They delete volume shadow copies, modify Group Policy Objects to disable antivirus, and use batch files to orchestrate encryption and log deletion. Ransom demands range from $1M to $10M USD, with the largest reaching $60M; payment is demanded in Bitcoin through .onion URLs. Recently, direct telephonic and email contact from threat actors has increased. The group has demonstrated willingness to negotiate.

## Mentioned in this report

- Threat actors: BlackSuit
- Malware: BlackSuit, Cobalt Strike, Gootloader, Gozi, Rclone, SystemBC, Ursnif

## Detection guidance (public sample)

### Volume Shadow Copy Deletion via Vssadmin, WMIC or PowerShell

ATT&CK: T1490

Detects deletion of volume shadow copies using vssadmin, wmic shadowcopy or Win32_ShadowCopy, a standard step before ransomware encryption as described for BlackSuit/Royal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Volume Shadow Copy Deletion via Vssadmin, WMIC or PowerShell
description: Detects deletion of volume shadow copies via vssadmin, wmic shadowcopy
  or Win32_ShadowCopy, a common ransomware pre-encryption step (BlackSuit/Royal delete
  shadow copies before encrypting). Matches the command pattern, not a specific batch
  filename.
tags:
- attack.impact
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains|all:
    - Win32_ShadowCopy
    - Delete
  condition: 1 of selection_*
falsepositives:
- Backup or storage maintenance scripts that purge old shadow copies
- Administrators manually freeing disk space
level: high
id: b842eacc-2ce2-56dd-bbea-b9a226741b96
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a
```

### Mass Windows Event Log Clearing via Wevtutil in Batch Script

ATT&CK: T1685.005

Detects wevtutil clearing logs, including when launched from cmd running a batch file, as used by BlackSuit batch scripts for log deletion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Mass Windows Event Log Clearing via Wevtutil in Batch Script
description: Detects wevtutil.exe clearing event logs (cl / clear-log), including
  when launched by cmd.exe running a .bat file, matching the batch-file log deletion
  used by BlackSuit operators.
tags:
- attack.defense-impairment
- attack.t1685.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_wevtutil:
    Image|endswith: \wevtutil.exe
    CommandLine|contains:
    - ' cl '
    - clear-log
  selection_bat_parent:
    ParentImage|endswith: \cmd.exe
    ParentCommandLine|contains: .bat
  condition: selection_wevtutil and selection_bat_parent
falsepositives:
- Administrators clearing logs via maintenance batch scripts
- Lab or image-preparation scripts resetting event logs
level: high
id: 6c62fe66-a46f-5b59-a660-72bd3fbc8862
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a
```

### Cobalt Strike and BlackSuit Named Pipe Creation

ATT&CK: T1021.002

Detects creation of named pipes associated with Cobalt Strike and BlackSuit tooling used for C2 and lateral movement. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cobalt Strike and BlackSuit Named Pipe Creation
description: Detects creation of named pipes known from Cobalt Strike (hashdump, MSSE-*-server,
  WkSvcPipeMgr_*) and BlackSuit, as used for post-exploitation and lateral movement
  in this campaign.
tags:
- attack.lateral-movement
- attack.t1021.002
- attack.execution
logsource:
  category: pipe_created
  product: windows
detection:
  selection_wksvc:
    PipeName|contains: \WkSvcPipeMgr_
  selection_msse:
    PipeName|startswith: \MSSE-
    PipeName|endswith: -server
  selection_other:
    PipeName:
    - \hashdump
    - \334485
    - \461092
  condition: 1 of selection_*
falsepositives:
- Red team exercises using default Cobalt Strike profiles
- Rare legitimate software using a pipe with a coincidentally similar name
level: high
id: f6b70526-2cc4-554a-aa52-1e1a27153ea8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2f961c14-a925-59c4-a67f-5e0ac57cfc10/blacksuit-ransomware-evolution-of-royal-with-improved-capabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup