InfoSecBulletin Cybersecurity for mankind
The FBI and CISA updated their advisory to confirm that the Royal ransomware group now goes by the name “BlackSuit” and still demands very high ransom amounts, up to $60 million.
The advisory has new technical information to help defenders detect the activity of the group, known as Royal ransomware from September 2022 to July 2023 and now called BlackSuit.
Apple Warns of 3 Zero Day Vulns Actively Exploited
24,000 unique IP attempted to access Palo Alto GlobalProtect portals
CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access
Australian fintech database exposed in 27000 records
Over 200 Million Info Leaked Online Allegedly Belonging to X
FBI investigating cyberattack at Oracle, Bloomberg News reports
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
CIRT alert Situational Awareness for Eid Holidays
The group got attention from the police last summer when they attacked Dallas, causing damage to the city’s emergency services, courts, and government. In November, the FBI and CISA warned that Royal was transitioning to the “BlackSuit” branding for attacks. The latest update confirms that all of the group’s new attacks, some as recent as July, are linked to the new name.
“Ransom demands have typically ranged from approximately $1 million to $10 million, with payment demanded in Bitcoin,” the agencies said. “BlackSuit actors have exhibited a willingness to negotiate payment amounts.”
The agencies linked the hackers behind the two groups based on “numerous coding similarities” but noted that BlackSuit has “exhibited improved capabilities.”
Hackers still rely on phishing emails to launch successful attacks. They use these emails to gain initial access, disable antivirus software, steal a lot of data, and deploy ransomware.
The agencies noted there has been a recent uptick in attacks where victims “received telephonic or email communications from BlackSuit actors regarding the compromise and ransom.”
A new report from Sophos, a cybersecurity company, revealed that several ransomware groups are using this tactic to pressure victims into paying ransoms. Ransomware gangs have been contacting patients and customers of multiple hospitals and businesses, threatening them with data stolen or accessed during attacks.
According to Chester Wisniewski, Sophos Field CTO, ransomware gangs used to rely on media coverage to scare victims. However, in recent times, these groups have started directly contacting customers and patients as a new way to apply pressure.
Wisniewski argued that the tactic has not been successful, as companies mostly base their decision to pay ransoms on practical factors such as business downtime and regulatory concerns.
