Executive Summary
A December 2023 intrusion, attributed to BlackSuit ransomware operators, demonstrated a multi-stage attack lifecycle spanning 15 days. The campaign utilized Cobalt Strike for initial command and control, leveraging CloudFlare as a proxy to mask traffic, and subsequently pivoted through domain controllers to perform extensive internal reconnaissance.
Technically, the actor employed a variety of open-source and specialized tools including Rubeus for AS-REP roasting and Kerberoasting, SharpHound for Active Directory mapping, and SystemBC for SOCKS5 proxying and persistent C2. Lateral movement was achieved through SMB ADMIN$ shares and RDP sessions. Final impact involved the manual deployment of the BlackSuit binary (qwe.exe) across critical infrastructure.
This threat is highly significant for organizations due to its prolonged dwell time and the use of legitimate administrative tools (RDP, SMB, and standard Windows utilities) for malicious purposes. The reliance on manual execution for the final ransomware stage highlights an operator-led approach aimed at maximizing encryption coverage and business impact.
Key Details
Threat Name
BlackSuit Ransomware
Affects
—
Adversary
—
MITRE Techniques
Malware/Tools
BlackSuit, Cobalt Strike, SystemBC, Rubeus, SharpHound