The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the Federal Bureau of Investigation (FBI), issued an updated advisory on BlackSuit ransomware, previously known as Royal ransomware. The advisory provides detailed insights into the tactics, techniques, and procedures (TTPs) as well as indicators of compromise (IOCs) tied to BlackSuit, based on recent investigations. This information is essential for network defenders to understand the ongoing threats and employ effective defenses against this evolving malware.
BlackSuit ransomware has targeted a wide range of critical infrastructure sectors, including commercial facilities, healthcare and public health, government entities, and the critical manufacturing industry. These sectors are particularly vulnerable as BlackSuit leverages sophisticated methods to breach systems and disrupt operations, posing a severe risk to essential services and operations.
To mitigate the impact of BlackSuit, CISA recommends that network defenders carefully review the advisory and implement the suggested protective measures. These recommendations include strategies for ransomware prevention, detection, and response, providing organizations with guidance to address potential ransomware infections before they escalate.
Additionally, CISA encourages software manufacturers to adopt “secure by design” principles to enhance security for their customers. By building security into software products from the outset, developers can reduce vulnerability risks. For further resources, CISA directs organizations to its Cross-Sector Cybersecurity Performance Goals, which offer baseline protections, and a guide on secure by design principles to help organizations shift the cybersecurity risk balance.
Reference:
