The BlackSuit ransomware, formerly known as Royal ransomware, has emerged as a significant cyber threat since its inception. Initially identified as Quantum ransomware in January 2022, the group rebranded to Royal in September 2022. Following a high-profile attack on the City of Dallas in June 2023, the group transitioned to the BlackSuit moniker, ceasing Royal-branded operations entirely. Since rebranding, BlackSuit has demanded over $500 million in ransoms, with individual demands reaching up to $60 million. The group has targeted over 350 organizations since September 2022, including critical infrastructure sectors such as healthcare, government facilities, and manufacturing. Their ransom demands typically range from $1 million to $10 million, payable in Bitcoin. The ransomware gang employs various infection vectors, including phishing emails, Remote Desktop Protocol (RDP), and exploitation of vulnerable internet-facing applications, often purchasing access through initial access brokers (IABs). BlackSuit operations involve sophisticated techniques to gain initial access, disable antivirus software, and exfiltrate sensitive data before deploying ransomware. They utilize legitimate remote monitoring and management (RMM) software, tools like SystemBC and GootLoader, and credential-stealing utilities such as Mimikatz and Nirsoft’s password harvesting tools. The ransomware’s capabilities include enumerating victim networks, killing system processes, and maintaining persistence through tools like SharpShares and SoftPerfect NetWorx. The FBI and CISA have been actively tracking and updating advisories on BlackSuit, providing technical data and indicators of compromise (IOCs) to help defenders detect and mitigate the group’s activities. The latest advisory includes insights from incidents as recent as July 2024, highlighting the group’s use of telephonic and email communications to pressure victims into paying ransoms. The group’s aggressive methods, including assessing stolen data for regulatory non-compliance and threatening to expose sensitive information, reflect another growing trend of ransomware gangs leveraging reputational damage as a coercive tactic. As ransomware tactics continue to evolve, comprehensive cybersecurity strategies and proactive threat intelligence sharing remain essential in defending against these pervasive threats. CTIX analysts will continue to share the most recent developments among threat actor activities to help combat the threats that come with an ever-changing cyber landscape.