black suit
- First seen
- 2023-05-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:48:35
Context
BlackSuit is a type of malicious software classified as ransomware. Its operation involves multifaceted extortion, encrypting and exfiltrating victim data, and hosting public data leak sites for victims who fail to meet its demands. BlackSuit’s activities first began in early May 2023. Designed to prevent access to files by encrypting them, this ransomware appends the “.blacksuit” extension to the names of all affected files. Furthermore, it changes the desktop wallpaper and creates a ransom note file named “README.BlackSuit.txt.” This threat actor targets large corporations, small and medium-sized enterprises (SMEs), with no apparent specific discrimination regarding industry or type of victim.
Reports & references
- CISA — Aa23 284A (report)
- ransomlook.io — Black Suit (report)
- ransomware.live — Blacksuit (report)
- Trend Micro — Blacksuit Ransomware And Its Similarities To Royal (report)
- sentinelone.com — Blacksuit Ransomware A Former Conti Affiliate Rebrands And Evolves (report)
- bleepingcomputer.com — Blacksuit Ransomware A New Name For Royal Gang (report)