blacksuit Ransomware
Tracked since Jun 12, 2023
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1021.001 Remote Services: Remote Desktop ProtocolT1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1566 PhishingT1566.001 Phishing: Spear phishing AttachmentT1566.002 Phishing: Spear phishing Link Privilege Escalation
T1078 Valid AccountsT1078.002 Valid Accounts: Domain Accounts Defense Evasion
T1021.001 Remote Services: Remote Desktop ProtocolT1070.001 Indicator Removal: Clear Windows Event LogsT1119 Automated CollectionT1484.001 Domain Policy Modification: Group Policy ModificationT1562.001 Impair Defenses: Disable or Modify Tools Command and Control
T1105 Ingress Tool TransferT1572 Protocol Tunneling Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System Recovery Resource Development
T1650 Acquire Access Observed tools
Credential Theft
AccountRestore · Mimikatz · NirSoft Dialupass · NirSoft IEPassView (iepv) · NirSoft MailPassView · NirSoft Netpass · NirSoft RouterPassView
Defense Evasion
Eraser · GMER · Inno Setup · PowerTool · VirtualBox
Discovery Enum
AdFind · Advanced IP Scanner · SharpHound · SharpShares · SoftPerfect NetScan
Exfiltration
7-Zip · Bublup · RClone · Temp[.]sh
LOLBAS
NTDS Utility (ntdsutil) · PowerShell · PsExec · WMIC · attrib
Networking
Chisel · Cloudflared · OpenSSH
Offsec
Brute Ratel C4 · Cobalt Strike · Rubeus
RMM-Tools
AnyDesk · Atera · LogMeIn · MobaXterm
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live