BlackSuit Claims Dozens of Victims With Carefully Curated Ransomware

ReliaQuest analyzed an April intrusion by the BlackSuit ransomware group—an offshoot of Royal/Conti actors—that targeted US critical-sector organizations, exfiltrated over 100 GB of data, and deployed ransomware to hundreds of hosts using tactics including VPN credential abuse, Kerberoasting, PsExec lateral movement, FTP exfiltration, and VM-based obfuscation; the group practices double-extortion and has leaked data from 53 organizations over a year. The report details the attack chain, detection and remediation actions taken, and mitigation recommendations to harden VPNs, logging, and Active Directory protections.