CDK Global BlackSuit Ransomware Incident
Key Facts
- Legal Status: ALLEGED in U.S. District Court for the Northern District of Illinois.
- Primary Target Sector: Information Technology, Retail, Automotive.
- Documented Financial Loss: $1.0 billion.
- 3 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Destructive ransomware incident that incapacitated CDK Global, the premier SaaS dealer management platform for approximately 15,000 car dealerships across North America. Attackers deployed BlackSuit ransomware throughout CDK cloud and on-premises data centers, forcing dealership employees into pen-and-paper workarounds for weeks until an estimated $25 million ransom was transferred.
Root Cause & Infiltration Vector
Adversaries gained initial ingress to CDK Global internal network infrastructure via compromised administrative credentials, subsequently establishing an undetected command foothold.
Operational Impact & Financial Blast Radius
Shutdown of CDK dealer management systems utilized by approximately 15,000 car dealerships in the United States and Canada. Dealerships were unable to process new vehicle purchases, register titles, order replacement parts, or service vehicles for nearly two weeks. Industry sales losses estimated in the billions, with an estimated $25M ransom payment.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
BlackSuit ransomware affiliates authenticated to internal CDK management subnets using valid administrator credentials that lacked second-factor validation.
Attackers executed vssadmin commands to destroy local Volume Shadow Copies and attempted to disable host monitoring agents across hypervisor hosts.
Adversaries unleashed the BlackSuit encryption binary across both Windows server clusters and VMware ESXi hypervisors, encrypting database virtual disks (.vmdk) simultaneously.
As CDK engineering teams attempted to bring backup systems online, the ransomware detonated a second time across newly exposed environments, forcing an extended blackout.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
CDK Global detects BlackSuit ransomware executing across core servers and shuts down systems.
A second encryption wave triggers during restoration efforts, shutting down dealership services again.
CDK Global transfers 387 Bitcoin (approx. $25M) to a BlackSuit extortion address to obtain decryptor.
Core dealer management system services are restored to nearly all 15,000 dealerships.
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1078 | Valid Accounts Defense Evasion | "Attackers gained access to CDK enterprise networks using compromised administrator credentials, bypassing secondary verification checks." | Class Action Complaint: 1:24-cv-05231 (N.D. Ill.) | reviewed |
| T1486 | Data Encrypted for Impact Impact | "BlackSuit ransomware payloads encrypted virtualized database instances, dealer inventory feeds, and customer relationship management clusters." | CISA & FBI Joint Advisory AA24-220A (BlackSuit) | reviewed |
| T1490 | Inhibit System Recovery Impact | "The ransomware deleted Volume Shadow Copies and backup catalogues, crippling initial automated recovery attempts and forcing a secondary blackout." | CISA Advisory AA24-220A Technical Details | reviewed |