MITRE ATT&CK G1025
BlackSuit Ransomware Group
View MITRE Group Page ↗
Aliases: Royal Ransomware Successor, BlackSuit
Official Attribution Source: CISA & FBI Joint Cybersecurity Advisory AA24-220A (BlackSuit)
Key Facts
Jurisdiction
Russian Federation
Geographic origin
Cases
1
Prosecution matters
Defendants
0
Indicted individuals
Sanctions
0
OFAC designations
- Attributed Country: Russian Federation.
- ATT&CK Group Reference: G1025 (BlackSuit Ransomware Group).
- Linked to 1 primary court prosecution record(s) with $1.0 billion documented loss.
- Identified 0 individually charged operative(s) and 0 OFAC designation(s).
Primary ATT&CK Techniques Employed
| Technique | Frequency |
|---|---|
| T1078 Valid Accounts | 1 incidents |
| T1486 Data Encrypted for Impact | 1 incidents |
| T1490 Inhibit System Recovery | 1 incidents |
Prosecution Cases Attributed to BlackSuit Ransomware Group
CDK Global BlackSuit Ransomware Incident
alleged 2024-06-19
Destructive ransomware incident that incapacitated CDK Global, the premier SaaS dealer management platform for approximately 15,000 car dealerships across North America. Attackers deployed BlackSuit ransomware throughout CDK cloud and on-premises data centers, forcing dealership employees into pen-and-paper workarounds for weeks until an estimated $25 million ransom was transferred.
Primary Attack Mechanism: Adversaries gained initial ingress to CDK Global internal network infrastructure via compromised administrative credentials, subsequently establishing an undetected command foothold.
3 techniques mapped · Loss: $1.0 billion
View full case dossier →
Documented TTP Signature for BlackSuit Ransomware Group
Test Controls in Stack Audit →T1078: Valid Accounts
Adversaries obtain and misuse legitimate credentials of existing user accounts to maintain persistence and bypass controls.
T1486: Data Encrypted for Impact
Adversaries encrypt victim files and databases to disrupt business operations and demand financial extortion.
T1490: Inhibit System Recovery
Adversaries delete volume shadow copies and system restore points to prevent recovery from ransomware.