Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware

Unit 42 details a ramp-up in BlackSuit (Ignoble Scorpius) ransomware activity since its May 2023 rebrand of Royal, attributing at least 93 global victims and a preference for education, construction and manufacturing sectors. The report analyzes Windows and ESXi variants that append .blacksuit, describes initial access (phishing, GootLoader, supply-chain, stolen VPN creds), credential theft (Mimikatz, NanoDump, DCSync), lateral movement and persistence (RDP, SMB, PsExec, Cobalt Strike), data exfiltration (Rclone, Bublup, WinSCP), destructive impact (shadow copy deletion), and provides MITRE ATT&CK mappings, Cortex XDR XQL detections, IOCs (mutex, ransom note names) and mitigations.