Sarina

I. Targeted Entities

• Healthcare sector
• Education sector
• Government organizations
• Manufacturing industries
• Retail industries

II. Introduction

New Indicators of Compromise associated with BlackSuit ransomware have been found in recent attacks. BlackSuit is a sophisticated cyber threat known for its double extortion tactics, encrypting and exfiltrating victim data to demand ransom.

III. Additional Background Information

BlackSuit ransomware emerged as a prominent threat actor in the cyber landscape in 2023. It is believed to be a direct successor to the Royal ransomware, itself a descendant of the notorious Conti ransomware group. BlackSuit shares significant code similarities with Royal, including encryption algorithms and communication methods, indicating that the operators behind BlackSuit have inherited and improved upon Royal’s techniques. An analysis made by Trend Micro revealed that BlackSuit and Royal ransomware have a high degree of similarity, with 98% similarities in functions, 99.5% similarities in blocks, and 98.9% similarities in jumps. Additionally, BlackSuit employs command-line arguments like those used by Royal, though with some variations and additional arguments.

This technical sophistication has allowed BlackSuit to conduct multiple high-profile attacks across various sectors since its emergence. Notably, one of the most significant attacks targeted a U.S.-based healthcare provider in October 2023, resulting in severe operational disruptions. The financial losses from this attack were estimated to be in the millions, including ransom payments and the cost of recovery and mitigation. In another incident, an educational institution suffered a data breach, leading to the exposure of sensitive student and staff information.

Financial gain is the primary motivation behind BlackSuit attacks. The group employs double extortion tactics, demanding ransom not only to decrypt the data but also to prevent the leaked data from being publicly released. This strategy increases the pressure on victims to pay the ransom, highlighting the ruthlessness and effectiveness of BlackSuit’s extortion methods.

Tools Used

• Blacksuit ransomware: The main payload used for encrypting victim data.
• Bravura Optitune: Legitimate remote monitoring and management (RMM) software used for maintaining remote access.
• InfoStealer: Malware designed to steal sensitive information, including credentials and financial data.
• NetScan: SoftPerfect Network Scanner (netscan.exe), a publicly available tool used for discovering host names and network services.
• Process Explorer: A Microsoft Sysinternals tool that provides detailed information about processes running on a system, used for monitoring and debugging.
• ProcessHacker: A free tool for monitoring system resources, debugging software, and detecting malware.
• PsKill: Microsoft Sysinternals command-line tool used to terminate Windows processes on local or remote systems.
• PsSuspend: Microsoft Sysinternals command-line tool used to suspend processes on a local or remote system.
• PsExec: A Microsoft Sysinternals tool for executing processes on other systems, primarily used by attackers for lateral movement.
• Rclone (suspected): An open-source tool that can manage content in the cloud, often abused by ransomware actors to exfiltrate data from victim machines.

These tools allow BlackSuit to conduct reconnaissance, maintain persistence, and execute their ransomware effectively. The group’s preference for leveraging legitimate software tools makes their activities harder to detect and mitigate. Understanding the tools and methods employed by BlackSuit ransomware is critical for defending against their attacks.

IV. MITRE ATT&CK

VII. References

Blacksuit (2024) SentinelOne. Available at: https://www.sentinelone.com/anthology/blacksuit/ (Accessed: 08 June 2024).

Montalbano, E. (2024) BlackSuit claims dozens of victims with ransomware, BlackSuit Claims Dozens of Victims With Ransomware. Available at: https://www.darkreading.com/cyberattacks-data-breaches/blacksuit-dozens-victims-curated-ransomware (Accessed: 08 June 2024).

Threat Advisory created by The Cyber Florida Security Operations Center. Contributing Security Analysts: Yousef Blassy, Thiago Pagliaroni, Yousef Aref, Abdullah Siddiqi, and Nahyan Jamil.

I. Targeted Entities

Enterprises and Government Organizations

II. Introduction

LockBit ransomware operators have deployed a new AV-bypass tool named “Warp AVKiller” in their latest campaigns, as identified by a trusted third party. This advanced tool, derived from the Go-based Warp Stealer malware, is engineered to evade detection by security products. The attack methodology includes creating new user accounts through Windows Management Instrumentation (WMI), integrating them into a Local Group, and configuring them in the Windows Autologon registry entry. This setup ensures that the new user accounts automatically log in upon system restart, initiating the execution of LockBit ransomware. The Cybersecurity and Infrastructure Security Agency (CISA) and The US Department of Homeland Security (DHS) urges immediate review and reinforcement of security protocols to counter this threat.

III. Additional Background Information

LockBit is a ransomware-as-a-service business that allows less technical users to purchase ready-made ransomware toolkits to launch their own cyberattacks. LockBit creates malware and licenses the code in exchange for a percentage of the ransoms paid.

Several sources, including CISA, say that LockBit was the most deployed ransomware variant across the world. LockBit ransomware is responsible for numerous cyberattacks worldwide. Initially detected in 2019, it has evolved through multiple versions, with LockBit 3.0 being the latest. This ransomware gains initial access via purchased credentials, unpatched vulnerabilities, or insider threats. It employs a double extortion tactic, encrypting data and threatening to release it unless the ransom is paid. LockBit targets mid-sized organizations, leveraging its Ransomware-as-a-Service model for widespread distribution.

In recent news, The Lockbit ransomware group claimed to have breached the US Federal Reserve, stating that they exfiltrating 33 TB of sensitive data, such as Americans’ banking secrets. They added the Federal Reserve to their Tor data leak site and threatened to leak the stolen data on June 25, 2024. Lockbit did exfiltrate 33 TB of sensitive data, but it was not the Federal Reserve. LockBit targeted Evolve Bank & Trust, a US banking company. Evolve confirmed the breach, stating that the stolen data originated from this incident.

IV. Recommendations

VI. References

(1) Sophia, Fox-Sowell “FBI obtains 7,000 lockbit ransomware decryption keys” StateScoop, June 6, 2024 https://statescoop.com/fbi-obtains-7000-lockbit-ransomware-decryption-keys/#:~:text=LockBit%20creates%20malware%20and%20licenses,across%20the%20world%20in%202022

(2) “What Is LockBit Ransomware?” Blackberry, 2021 https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/lockbit

(3) “Lockbit ransomware – what you need to know” Kaspersky, 2020 https://usa.kaspersky.com/resource-center/threats/lockbit-ransomware

(4) Paganini, P, “Fox-Sowell “Lockbit claims the hack of the US Federal Reserve.” Security Affairs, June 24, 2024 https://statescoop.com/fbi-obtains-7000-lockbit-ransomware-decryption-keys/#:~:text=LockBit%20creates%20malware%20and%20licenses,across%20the%20world%20in%202022

Threat Advisory created by The Cyber Florida Security Operations Center. Contributing Security Analysts: Yousef Blassy and Nahyan Jamil.