InfoSecBulletin Cybersecurity for mankind
The FBI and CISA updated their advisory to confirm that the Royal ransomware group now goes by the name “BlackSuit” and still demands very high ransom amounts, up to $60 million.
The advisory has new technical information to help defenders detect the activity of the group, known as Royal ransomware from September 2022 to July 2023 and now called BlackSuit.
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
The group got attention from the police last summer when they attacked Dallas, causing damage to the city’s emergency services, courts, and government. In November, the FBI and CISA warned that Royal was transitioning to the “BlackSuit” branding for attacks. The latest update confirms that all of the group’s new attacks, some as recent as July, are linked to the new name.
“Ransom demands have typically ranged from approximately $1 million to $10 million, with payment demanded in Bitcoin,” the agencies said. “BlackSuit actors have exhibited a willingness to negotiate payment amounts.”
The agencies linked the hackers behind the two groups based on “numerous coding similarities” but noted that BlackSuit has “exhibited improved capabilities.”
Hackers still rely on phishing emails to launch successful attacks. They use these emails to gain initial access, disable antivirus software, steal a lot of data, and deploy ransomware.
The agencies noted there has been a recent uptick in attacks where victims “received telephonic or email communications from BlackSuit actors regarding the compromise and ransom.”
A new report from Sophos, a cybersecurity company, revealed that several ransomware groups are using this tactic to pressure victims into paying ransoms. Ransomware gangs have been contacting patients and customers of multiple hospitals and businesses, threatening them with data stolen or accessed during attacks.
According to Chester Wisniewski, Sophos Field CTO, ransomware gangs used to rely on media coverage to scare victims. However, in recent times, these groups have started directly contacting customers and patients as a new way to apply pressure.
Wisniewski argued that the tactic has not been successful, as companies mostly base their decision to pay ransoms on practical factors such as business downtime and regulatory concerns.
