di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DEPLOYMENT

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE LEGACY AV

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

Take a deep dive into BlackSuit ransomware and explore its capabilities, deployment, and some current targets. Explore how Deep Instinct is able to detect and prevent BlackSuit from taking advantage of your data.

BlackSuit_900x400_2.png

Five weeks ago, the KADOKAWA corporation began to experience service outages affecting multiple websites. The outages spread to other operations and were identified as a <a href="https://www.bleepingcomputer.com/news/security/blacksuit-ransomware-gang-claims-attack-on-kadokawa-corporation/">ransomware attack</a> by the BlackSuit ransomware group. BlackSuit claimed responsibility and threatened the public release of stolen information on July 1st unless their ransom demands were met.&nbsp;&nbsp;BlackSuit's ransomware is very similar to the Royal ransomware strain, which itself is considered the successor to the notorious Conti group. This suggests potential connections or shared developers. This connection can be explained in more detail in some of our older material that has been published on the subject: we examined both <a href="https://info.deepinstinct.com/conti-leaks-cyber-threat-reports">Conti</a> and <a href="https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence">BlackBasta</a>, a Conti offshoot.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt360d20b0f113f264/6696f82b06a674d134c5a4ee/fig1-blacksuit-victims.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1: BlackSuit ransomware victims</figcaption></div></figure>Based on our analysis, we found that Deep Instinct prevents&nbsp;all new Blacksuit Windows Ransomware samples with an eight-month-old brain. Across the industry, however, these samples have a much lower detection rate than earlier sample versions of BlackSuit. As demonstrated in the graph above, that lower detection rate matches the sudden growth of BlackSuit ransomware victims.&nbsp;The samples BlackSuit is using are well designed for infiltration of legacy systems. Let’s take a closer look.&nbsp;<h5>Latest samples analysis:</h5>Newer samples of BlackSuit’s code mainly added additional layers of complications like encoding strings and imported DLLs for Anti-Analysis. They also added a mandatory ID argument to bypass automatic emulation, making the new samples more evasive.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2084d114ec3f8209/6696f82b77a7809e9044a25f/fig2-strings-encryption.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2: String decryption</figcaption></div></figure>For example, according to VirusTotal, even though old Blacksuit samples have a high detection rate, the new samples from recent months have a much lower detection rate, indicating significant changes.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5bed08ab64e581fe/6696f82cd0c0ef789ec561b6/fig3-VT-detection-rate.png" width="auto" height="auto" style="text-align: center;max-width: auto;width: auto;height: auto;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3: Detection rate in VirusTotal of new Blacksuit samples when first submitted</figcaption></div></figure>One of the more impactful changes allowed the threat actor to mask the ransomware as a legitimate part of a known free antivirus, Qihoo 360, including false watermarking. This masking has drastically lowered detection. The ransomware is hidden deep inside the legitimate looking application and only has to be executed with a token in the command line to operate as a ransomware.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteae79a1729b07bfd/6696f82c77a780582d44a263/fig4-embedded-legitimate-urls.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4: Embedded URLs</figcaption></div></figure><figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4e96f1780d57f20a/6696f82c6c1019fd6f39795e/fig5-fake-metadata.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 5: Fake Metadata</figcaption></div></figure>The masquerade file is not signed, indicating this is not the real Qihoo application. The functionality post infiltration remained the same as the other new samples, including the same mutex used.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3971600a651708d4/6696f82c79f2042205390cf0/fig6-VT-detectio-rate-stealthy-sample.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 6: VirusTotal detection rate.</figcaption></div></figure>

The main portion of the executable is nearly identical to Qihoo's real QHAccount.exe file, resulting in security software evasion.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="image003.jpg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5dac21065b6f0d02/66990ac7d316c70da3b3419f/image003.jpg" height="auto" /><figcaption style="text-align: center;" style="text-align: center;">Figure 7: Side by side comparison of BlackSuit and Qihoo executables</figcaption></div></figure>Disclaimer: The official Qihoo 360 is not in any way involved with BlackSuit. The masking is the work of bad actors assuming Qihoo’s identity.&nbsp;<h5>Behaviors:</h5>The common behavior shared with all Windows samples didn’t change much and the main functionality remained the same, though some commands have changed:<table><tbody><tr><td>-p&nbsp;</td><td>Specifies the target directory where the ransomware will encrypt files&nbsp;</td></tr><tr><td>-killvm&nbsp;</td><td>Terminates the virtual machine (VM), preventing analysis&nbsp;</td></tr><tr><td>-allfilesEncrypt&nbsp;</td><td>Encrypts all accessible files, maximizing damage&nbsp;</td></tr><tr><td>-networkEncrypt&nbsp;</td><td>Encrypts files on connected network drives, spreading the attack&nbsp;</td></tr><tr><td>-localEncrypt&nbsp;</td><td>Restricts encryption to the local machine storage, limiting immediate impact&nbsp;</td></tr><tr><td>-percentEncrypt&nbsp;</td><td>Encrypts a specified percentage of files, potentially increasing performance&nbsp;</td></tr><tr><td>-demonoff&nbsp;</td><td>Operates in stealth mode, making detection harder&nbsp;</td></tr><tr><td>-list {file}&nbsp;</td><td>A targeted list of files to be included in the encryption process&nbsp;</td></tr><tr><td>-delete&nbsp;</td><td>The ransomware deletes itself after execution, hindering investigation&nbsp;</td></tr><tr><td>-thrcount {number}&nbsp;</td><td>Specifies the number of threads used for encryption, impacting both performance and resource usage.&nbsp;</td></tr><tr><td>-skip {file}&nbsp;</td><td>A list of files to be excluded from encryption&nbsp;</td></tr><tr><td>-noprotect&nbsp;</td><td>Disables self-protection mechanisms, allowing termination of the ransomware&nbsp;</td></tr></tbody></table>&nbsp;The new samples have encoded strings to complicate analysis, and need to be supplied with -id &lt;32 characters&gt;. They can also receive additional instructions, such as:&nbsp;&nbsp;<table><tbody><tr><td>-ep&nbsp;</td><td>(like the previous percentEncrypt) sets a percentage of each file that will be encrypted. Partial encryption&nbsp;</td></tr><tr><td>-path&nbsp;</td><td>Specific directory to encrypt&nbsp;</td></tr><tr><td>-localonly&nbsp;</td><td>(an addition to the previous networkEncrypt) without network drives&nbsp;</td></tr><tr><td>-networkonly&nbsp;</td><td>(an addition to the previous networkEncrypt) without local files&nbsp;</td></tr><tr><td>-aavm&nbsp;</td><td>(like the previous allfilesEncrypt) encrypts everything&nbsp;</td></tr></tbody></table>&nbsp;BlackSuit ransomware also boasts a few other functionalities:&nbsp;<ul><li>Initiates Asymmetric Key Exchange to get the secret encryption key.&nbsp;</li></ul><ul><li>Deletes shadow copies, in order to disable easy local restore:&nbsp;</li></ul><ul><ul><li>vssadmin delete shadow /all /quiet&nbsp;&nbsp;</li></ul></ul><ul><li>Encrypts&nbsp;</li></ul><ul><ul><li>Appends .blacksuit to the encrypted files&nbsp;</li></ul></ul><ul><li>Skips:&nbsp;</li></ul><ul><ul><li>Various file types like executables, drivers, and installers to avoid breaking the system.&nbsp;</li></ul></ul><ul><ul><li>Already encrypted files and the ransom note.&nbsp;</li></ul></ul><ul><li>Eventually, BlackSuit’s ransomware is capable of disabling safe mode and shutting down the system:&nbsp;</li></ul><ul><ul><li>bcdedit /deletevalue {current} safeboot&nbsp;&nbsp;</li></ul></ul><ul><ul><li>shutdown /r /t 0&nbsp;</li></ul></ul><ul><li>Drops ransom note: Usually named readme.blacksuit.txt. The content text is encrypted to avoid signature detection for the ransom note. The note includes a link for communication with the threat actor for ransom negotiations.</li></ul><figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt771fca19a69b58a1" alt="fig7-ransom-note.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt771fca19a69b58a1/6696f82de13bf8b63bf84456/fig7-ransom-note.png" width="auto" height="128" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 8: BlackSuit’s ransom note</figcaption></div></figure><h5>Infection chain</h5>The common initial attack vectors are RDP (possibly with stolen credentials), VPN and firewall vulnerabilities, Office email attachments (Macros), Torrent websites, Malicious ads, and various 3rd-party trojans. And the attackers have also used tools like CobaltStrike, WinRAR, PUTTY, Rclone, Advanced IP Scanner, Mimikatz, and GMER. The variety of attack vectors opens the possibility for infection across a much broader target group, endangering large amounts of data.&nbsp;<h5>Leak and news site</h5>The BlackSuit group operates a news and leak site on the DarkWeb that includes all the known victims of the threat actors. Once the timer for the ransom payment ends, the exfiltrated data is published.&nbsp;Alleged victims of BlackSuit ransomware have their data published under a profile featuring key information about their organization, including industry, number of employees, revenue, and contact information.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="Figure 8: An example of an alleged victim's profile on BlackSuit's leak site " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6451cbdff41a7b39/6697d044d0c0efef3ec5697e/fig9-darkweb-leak_redact_WB.png" width="auto" height="auto" style="width: auto; height: auto;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 9: An example of a victim profile on BlackSuit's leak site</figcaption></div></figure><a href="https://info.deepinstinct.com/request-a-demo">Request a demo</a> to see how Deep Instinct can protect you from BlackSuit ransomware.&nbsp;Explore the BlackSuit IOCs below.<h5>IOCs</h5>f1684fb118d4d8fc56653fcc49e12a659b64c4459ba037fa94f21783235cc6ba&nbsp;dede96fd44c0f78eb79ceb63b898874e8922efc59d8bfb9f86505b1992bc00a3&nbsp; 6a2e454942cfeebb1140e1a28cb05fd49461d07792e97663378399c719fbc9ee&nbsp;79ab73a0e9dd8eac045c00fd1bd172a7f359588901f93c83e6740157eb21e7df&nbsp;7f09c2e35783fca69f0e12f31d767cecf8a98567f2b6f1e2d81d2b2e93fe6307&nbsp;60a9785ec20ec08b6792e304fc4b363abd54b8a7a2945dca9f97ee07783c4759&nbsp;5aeaa5c4f4100b2084814be72a695a5bf4a95fdb8a0c65704523608baa79b726&nbsp;d96ff4b3e188f7ff96ed28c1381a6318dd76bb1fbd6ca02c6ab0236e1c7f35aa&nbsp;3be3a3c2c1abc1d401e845a2b8952f4f3e55b510f3d6c1eb2a4503c7be09bec1&nbsp;90ae0c693f6ffd6dc5bb2d5a5ef078629c3d77f874b2d2ebd9e109d8ca049f2c&nbsp;6ad8215bd6b52d897dcfa0a9829720d0532adc741460ecb4b8f00c4427b6141c&nbsp;8605dec4ae4bd9f51297d1f244d0647bc0637d6ce6a957a5f810c64ae63276cb&nbsp; 2adcf43d221de2f72ba5088dac3a3193219412882df711d095f04e3f5b40767c&nbsp;&nbsp;readme.blacksuit.txt&nbsp;.blacksuit&nbsp;vssadmin delete shadows /all /quiet&nbsp;Mutex: WLm87eV1oNRx6P3E4Cy9&nbsp;

Deep Dive: Exposing Stealthy New BlackSuit Ransomware

DI_Uncorking Old Wine_TRT

Uncorking Old Wine: Zero-Day from 2017 + Cobalt Strike Loader in Unholy Alliance

Announcing DSX for Cloud - Amazon S3, natively integrated zero-day data security for AWS S3.