BlackSuit

Leveraging phishing emails with malicious PDF attachments (T1566.001/T1566.002), the group exploited public-facing applications (T1190) and utilized valid accounts (T1078) from compromised credentials. Remote Desktop Protocol (T1133) served as a common entry vector, with VPN vulnerabilities providing alternative access routes.

Network mapping and high-value target identification employed SharpShares, AdFind, and SoftPerfect NetWorx to enumerate shares and domain structures. BloodHound facilitated privilege escalation path discovery, while custom scripts identified backup systems for targeted destruction.

Deploying SystemBC backdoor for persistent access, the group established Cobalt Strike beacons across compromised networks. Brute Ratel provided advanced evasion capabilities, while AnyDesk and TeamViewer enabled legitimate-appearing remote access.

DLL side-loading techniques bypassed application whitelisting, while safe mode operation circumvented security controls. The group modified Windows Defender settings and terminated security processes using BYOVD (Bring Your Own Vulnerable Driver) techniques for kernel-level access.

Mimikatz deployment harvested credentials from memory, while LaZagne extracted stored passwords. LSASS dumping through ProcDump provided additional credential material. Kerberoasting attacks targeted service accounts for offline cracking.

SOCKS proxy infrastructure at 143.244.146.183:443 provided primary communication channels. CloudFlare tunneling obscured command traffic, while DNS over HTTPS evaded network monitoring. Backup C2 servers across multiple jurisdictions ensured operational resilience.

RDP hopping leveraged harvested credentials for network traversal. SMB exploitation and PsExec-based propagation spread ransomware payloads. Windows Management Instrumentation (WMI) enabled stealthy remote execution across domain-joined systems.

Tools including RClone, Brute Ratel, MegaSync, and custom Qt-based utilities extracted sensitive data before encryption. CloudFlare Workers and AWS S3 buckets served as staging infrastructure. Bandwidth throttling avoided detection during multi-terabyte transfers.

Creating scheduled tasks and modifying registry keys for autostart ensured survival across reboots. WMI event subscriptions provided fileless persistence, while Group Policy modifications maintained network-wide access.

Critical file encryption using AES-256 algorithms rendered systems inoperable. Volume shadow copy deletion prevented recovery, while backup system targeting eliminated restoration options. Service disruptions averaged 21 days with complete recovery extending to 45 days for complex environments.

Deploying AES-256 encryption via OpenSSL libraries, the ransomware implemented configurable partial encryption for rapid file locking. Multi-threading accelerated encryption across network shares, while safe mode deployment bypassed active security controls.

Direct victim contact via phone and email accelerated negotiation timelines. Partner and customer notification threats increased pressure, while 72-hour deadlines for initial contact created urgency. Progressive data release schedules maintained negotiation leverage throughout discussions.

Executing vssadmin.exe delete shadows eliminated recovery options. BCDEdit modifications prevented safe mode recovery, while Windows Event Log clearing obscured forensic evidence. Cipher.exe overwrote deleted files to prevent recovery.