BlackSuit is a private ransomware operation first identified in 2023 that uses a double-extortion model to maximize pressure on victims. The group encrypts critical systems and simultaneously steals sensitive data, threatening to publish the information on a dedicated leak site if ransom demands are not paid. BlackSuit has frequently targeted organizations in the manufacturing and industrial sectors, with a significant concentration of victims located in North America. This threat profile examines the group’s operational methods, targeted industries and regions, data leak practices, known tools, and associations with other cybercriminal organizations. It also analyzes attack behaviors across both Windows and Linux environments and maps its tactics, techniques, and procedures to the MITRE A

Join for free to read