blacksuit

T1021.001Remote Services: Remote Desktop Protocol

BlackSuit actors use RDP compromise as a secondary initial access vector.

T1133External Remote Services

BlackSuit actors gain initial access through a variety of RMM software.

T1190Exploit Public-Facing Application

BlackSuit actors gain initial access through public-facing applications.

T1566Phishing

BlackSuit criminals often obtain initial access to victim networks through phishing.

T1566.001Phishing: Spear phishing Attachment

BlackSuit agents have used malicious PDF document attachments in phishing campaigns.

T1566.002Phishing: Spear phishing Link

Actors gain initial access through malvertising links via emails and public websites.

T1078Valid Accounts

BlackSuit actors used a legitimate administrator account to gain access privileges to the domain controller.

T1078.002Valid Accounts: Domain Accounts

BlackSuit actors used encrypted files to create new administrator user accounts.

T1021.001Remote Services: Remote Desktop Protocol

BlackSuit actors used valid accounts to move laterally through the domain controller using RDP.

T1070.001Indicator Removal: Clear Windows Event Logs

BlackSuit actors deleted shadow files and system and security logs after exfiltration.

T1119Automated Collection

BlackSuit actors used registry keys to extract and collect files automatically.

T1484.001Domain Policy Modification: Group Policy Modification

BlackSuit actors modified Group Policy Objects to bypass antivirus protocols.

T1562.001Impair Defenses: Disable or Modify Tools

BlackSuit actors disabled antivirus protocols.

T1105Ingress Tool Transfer

BlackSuit actors used C2 infrastructure to download various tools.

T1572Protocol Tunneling

BlackSuit actors used an encrypted SSH tunnel to communicate within the C2 infrastructure.

T1486Data Encrypted for Impact

BlackSuit actors encrypted data to identify which files were being used or locked by other applications.

T1490Inhibit System Recovery

BlackSuit actors encrypted data to identify which files were being used or locked by other applications.

T1650Acquire Access

BlackSuit actors may leverage brokers to gain initial access.