Emulating the Elegant BlackSuit Ransomware

AttackIQ has released a new attack graph that emulates the tactics, techniques, and procedures associated with BlackSuit ransomware deployment. The emulation is intended to help customers validate security controls and their ability to defend against the threat. The release is based on behaviors reported by the Cybersecurity and Infrastructure Security Agency on August 27, 2024, and the DFIR Report on August 26, 2024. It replicates the sequence of behaviors observed when the ransomware is deployed on a compromised system. The emulation covers an execution and discovery stage that begins with deployment of the ransomware sample and includes attempts to detect debuggers through the IsDebuggerPresent API. It gathers system information via GetNativeSystemInfo, enumerates processes with CreateToolhelp32Snapshot along with Process32FirstW and Process32NextW, and determines regional context through EnumSystemLocalesW, GetLocaleInfoW, and GetUserDefaultLCID. An impact stage follows that deletes volume shadow copies using vssadmin.exe, identifies logical drives with GetLogicalDriveStringsW, enumerates files and directories via FindFirstFileW and FindNextFileW, and encrypts files using AES-256 in CTR mode for content and RSA-4096 for key encryption. Security teams can run the emulation in the AttackIQ Adversarial Exposure Validation platform to evaluate control performance against baseline behaviors, assess posture against an opportunistic adversary, and validate detection and prevention pipelines against a ransomware playbook. The assessment template generates data to support adjustments to security controls and overall program effectiveness.