Unit 42 researchers have observed an increase in BlackSuit ransomware activity beginning in March 2024 that suggests a ramp up of operations. This threat emerged as a rebrand of Royal ransomware, which occurred in May 2023. Unit 42 tracks the group behind this threat as Ignoble Scorpius.
Since the rebrand, Unit 42 has observed at least 93 victims globally, a quarter of which were in the construction and manufacturing industries. The group describes themselves as an “extortioner named BlackSuit” and claims to reverse file encryption for “quite a small compensation essentially.” Although the group states the compensation is small, Unit 42 has observed that, on average, the initial ransom demand is about equal to 1.6% of the victim organization’s annual revenue.
Read more…
Source: Trend Micro
Related:
- Play Your Cards Right: Detecting Wildcard DNS Abuse
December 1, 2021
The domain name system (DNS) maps names to addresses so that computers can communicate. The directions within the DNS exist largely in records where a specific name (such as paloaltonetworks.com) is mapped to pieces of data, such as IP addresses (for example, 34.107.151202). As the name suggests, wildcard DNS records are an exception to this ...
- Widespread ‘Smishing’ Campaign Defrauds Iranian Android Users
December 1, 2021
Attackers are impersonating the Iranian government in a widespread SMS phishing campaign that is defrauding thousands of Android users by installing malware on their devices that can steal their credit card data and siphon money from financial accounts. Researchers from Check Point Research estimate that the campaign, which sends so called “smishing” messages that entice victims ...
- APT annual review 2021
November 30, 2021
The Global Research and Analysis Team at Kaspersky posted the summary of most interesting trends and developments of the last 12 months. This is based on Kaspersky visibility in the threat landscape and it’s important to note that no single vendor has complete visibility into the activities of all threat actors. Private sector vendors play a ...
- Queensland government energy generator hit by ransomware
November 30, 2021
Queensland government-owned energy generator CS Energy said on Tuesday it was responding to a ransomware incident that occurred over the weekend. First reported by Energy Source & Distribution, the company said the incident has not impacted electricity generation at Callide and Kogan Creek power station, and it was looking to restore its network. ANZ regional director at ...
- Yanluowang: Further Insights on New Ransomware Threat
November 30, 2021
Yanluowang, the ransomware recently discovered by Symantec, a division of Broadcom Software, is now being used by a threat actor that has been mounting targeted attacks against U.S. corporations since at least August 2021. The attacker uses a number of tools, tactics, and procedures (TTPs) that were previously linked to Thieflock ransomware attacks, suggesting that ...
- UK spy chief warns China, Russia racing to master AI
November 30, 2021
The chief of the United Kingdom’s foreign spy service is to warn that China and Russia are racing to master artificial intelligence in a way that could revolutionise geopolitics over the next 10 years. Richard Moore, who heads the Secret Intelligence Service, known as MI6, is due to make his first public speech since becoming chief ...