BlackSuit Ransomware 9-Day VPN Brute-Force Intrusion

A high-confidence attribution to BlackSuit ransomware operators (a lineage of Royal and Conti) describes a nine-day attack lifecycle targeting an environment with weak perimeter security. The intrusion began with a three-day password-guessing campaign against VPN accounts lacking multi-factor authentication (MFA). Once initial access was established, the threat actor pivoted through the network using compromised service and domain administrator accounts, demonstrating an identity-centric approach rather than relying on software exploits.

Technically, the actor maintained persistence via a redicrt_x64.exe backdoor and systematically disabled Windows Defender real-time protection (Event ID 5001) across the network. Data was staged using WinRAR with a disciplined install-use-remove pattern to minimize footprints. The final impact involved the deployment of the 'file.exe' ransomware binary, which was in some cases staged via the SYSVOL share, leading to double-extortion through data theft and encryption.

This incident highlights the critical vulnerability of exposing remote access services without MFA and the limitations of endpoint security when defenders fail to protect administrative credentials or lack centralized logging.