BlackSuit

BlackSuit is a ransomware-as-a-service (RaaS) operation that emerged in May 2023 as a rebrand of Royal ransomware. Operated by the Ignoble Scorpius group, it targets organizations globally with a focus on construction, manufacturing, and education sectors. The group operates a dark web leak site for extortion and typically demands ransoms equal to about 1.6% of the victim organization's annual revenue. BlackSuit uses various initial access methods including phishing, SEO poisoning, legitimate VPN credentials, and supply chain attacks.