www.sentinelone.com Open in urlscan Pro
104.26.2.18  Public Scan

Form analysis
3 forms found in the DOM

GET https://www.sentinelone.com

<form autocomplete="off" method="get" action="https://www.sentinelone.com">
  <fieldset>
    <input type="search" name="s" placeholder="Search ..." value="">
    <button class="search" type="submit">
      <img class="lazy icon-search" src="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='24' height='24'><rect width='100%' height='100%' fill='none'/></svg>" style=""
        data-src="https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg" alt="Search Icon" width="24" height="24">
      <img class="lazy icon-down" src="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='18' height='16'><rect width='100%' height='100%' fill='none'/></svg>" style=""
        data-src="https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg" alt="Navigation Close Dark" width="18" height="16">
    </button>
  </fieldset>
</form>

<form id="mktoForm_2816" novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); width: 1601px;">
  <style type="text/css"></style>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="Email" id="LblEmail" class="mktoLabel mktoHasWidth" style="width: 0px;">
          <div class="mktoAsterix">*</div>
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Email" name="Email" placeholder="Business Email" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email"
          class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true" style="width: 164px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoNative" style="margin-left: 110px;"><button type="submit" class="mktoButton">Subscribe</button></span></div>
  <div class="marketo-legal">By clicking Subscribe, I agree to the use of my personal data in accordance with SentinelOne <a href="/legal/privacy-notice/">Privacy Notice</a>. SentinelOne will not sell, trade, lease, or rent your personal data to
    third parties. This site is protected by reCAPTCHA and the <a href="https://policies.google.com/privacy" target="_blank">Google Privacy Policy</a> and <a href="https://policies.google.com/terms" target="_blank">Terms of Service</a> apply.</div>
  <input type="hidden" name="formid" class="mktoField mktoFieldDescriptor" value="2816"><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="327-MNM-087">
</form>

<form novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;"></form>

Text Content

New! CNAPP That Helps You Think Like an Attacker with Singularity Cloud Native
Security. Learn More New! Singularity™ Cloud Native Security
Experiencing a Breach?
 * Small Business
 * Contact
 * Cybersecurity Blog


en
 * English
 * 日本語
 * Deutsch
 * Español
 * Français
 * Italiano
 * Dutch
 * 한국어

Platform
 * Platform Overview
    * Singularity Platform Welcome to Integrated
      Enterprise Security
      
    * How It Works The Singularity XDR Difference
      
    * Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
      
    * Pricing & Packaging Comparisons and Guidance at a Glance
      

 * Data & AI
    * Purple AI Accelerate SecOps with Generative AI
      
    * Singularity Data Lake AI-Powered, Unified
      Data Lake
      
    * Singularity Data Lake for Log Analytics Seamlessly ingest data
      from on-prem, cloud or hybrid environments
      

 * Endpoint Security
    * Singularity Endpoint Autonomous Prevention, Detection, and Response
      
    * Singularity XDR Native & Open Protection, Detection, and Response
      
    * Singularity RemoteOps Forensics Orchestrate Forensics at Scale
      
    * Singularity
      Threat Intelligence Comprehensive Adversary Intelligence
      
    * Singularity Vulnerability Management Application & Os Vulnerability
      Management
      

 * Cloud Security
    * Singularity Cloud Security Block Attacks With an
      AI-powered CNAPP
      
    * Singularity Cloud
      Native Security Secure Cloud and Development Resources
      
    * Singularity Cloud Workload Security Real-Time Cloud Workload Protection
      Platform
      
    * Singularity
      Cloud Data Security AI-Powered Threat Detection for Cloud Storage
      

 * Identity Security
    * Singularity Identity Identity Threat Detection
      and Response
      
    * Singularity Hologram Deception Protection
      

Why SentinelOne?
 * Why SentinelOne?
    * Why SentinelOne? Cybersecurity Built
      for What’s Next
      
    * Our Customers Trusted by the World’s Leading Enterprises
      
    * Industry Recognition Tested and Proven
      by the Experts
      
    * About Us The Industry Leader in Autonomous Cybersecurity
      

 * Compare SentinelOne
    * CrowdStrike Cyber Dependent
      on a Crowd
      
    * McAfee Pale Performance,
      More Maintenance
      
    * Microsoft Platform Coverage
      That Compromises
      
    * Trend Micro The Risk of DevOps Disruption
      
    * Palo Alto Networks Hard to Deploy,
      Harder to Manage
      
    * Carbon Black Adapt Only as Quickly
      as Your Block Lists
      
    * Symantec Security Limited
      to Signatures
      

 * Verticals
    * Energy
      
    * Federal Government
      
    * Finance
      
    * Healthcare
      
    * Higher Education
      
    * K-12 Education
      
    * Manufacturing
      
    * Retail
      

Services
 * Strategic Services
    * PinnacleOne Strategic Advisory Group
      
   
   Services Overview
 * Threat Services
    * WatchTower
      Threat Hunting Hunting for Emerging Threat Campaigns
      
    * Vigilance Respond
      MDR Dedicated SOC
      Expertise & Analysis
      
    * Vigilance Respond Pro
      MDR + DFIR 24x7 MDR with Full-Scale Investigation & Response
      

 * Support, Deployment, & Health
    * Technical Account Management Customer Success with Personalized Service
      
    * SentinelOne GO Guided Onboarding & Deployment Advisory
      
    * SentinelOne University Live and On-Demand Training
      
    * Support Services Tiered Support Options for Every Organization
      
    * SentinelOne Community Community Login
      

Partners
 * Our Network
    * MSSP Partners Succeed Faster
      with SentinelOne
      
    * Singularity Marketplace Extend the Power
      of S1 Technology
      
    * Cyber Risk
      Partners Enlist Pro Response
      and Advisory Teams
      
    * Technology Alliances Integrated, Enterprise-Scale Solutions
      
    * SentinelOne for AWS Hosted in AWS Regions Around the World
      
    * Channel Partners Deliver the Right
      Solutions, Together
      
   
   Program Overview

Resources
 * Resource Center
    * Case Studies
      
    * Data Sheets
      
    * eBooks
      
    * Reports
      
    * Videos
      
    * Webinars
      
    * White Papers
      
   
   View All Resources
 * Blog
    * Feature Spotlight
      
    * For CISO/CIO
      
    * From the Front Lines
      
    * Identity
      
    * Cloud
      
    * macOS
      
    * SentinelOne Blog
      
   
   Blog
 * Tech Resources
    * SentinelLABS
      
    * Ransomware Anthology
      
    * Cybersecurity 101
      

About
 * About SentinelOne
    * About SentinelOne The Industry Leader in Cybersecurity
      
    * Investor Relations Financial Information & Events
      
    * SentinelLABS Threat Research for
      the Modern Threat Hunter
      
    * Careers The Latest Job Opportunities
      
    * Press & News Company Announcements
      
    * Cybersecurity Blog The Latest Cybersecurity Threats, News, & More
      
    * F1 Racing SentinelOne &
      Aston Martin F1 Team
      
    * FAQ Get Answers to Our Most Frequently Asked Questions
      
    * DataSet The Live Data Platform
      
    * S Foundation Securing a Safer Future for All
      
    * S Ventures Investing in the Next Generation
      of Security and Data
      

en
 * English
 * 日本語
 * Deutsch
 * Español
 * Français
 * Italiano
 * Dutch
 * 한국어


Get a Demo
Back to Anthology


BLACKSUIT


Akira


BLACKSUIT RANSOMWARE: IN-DEPTH ANALYSIS, DETECTION, AND MITIGATION


WHAT IS BLACKSUIT RANSOMWARE?

The BlackSuit ransomware operation emerged in early April/May of 2023. The group
is a multi-pronged extortion outfit, encrypting and exfiltrating victim data and
hosting public data leak sites for those victims that fail to comply with their
demands. The group is known for significant attacks against entities in the
healthcare and education sectors, along with other critical industries.
BlackSuit is a private operation in that there are no public affiliates.
BlackSuit payloads contain many technical similarities to Royal ransomware
payloads such as similar encryption mechanisms and command-line parameters.








WHAT BLACKSUIT RANSOMWARE TARGET?

BlackSuit is a private ransomware/extortion operation. Large enterprises and
small to medium-sized businesses (SMBs) are targeted, though there does not
appear to be any specific discrimination when it comes to industry or type of
target. Similar to Royal, targeting of entities in the CIS (Commonwealth of
Independent States) appears to be excluded. To date, BlackSuit targeting has
favored those in the healthcare, education, information technology (IT),
government, retail, and manufacturing industries.








HOW DOES BLACKSUIT RANSOMWARE WORK?

The group emerged with payloads that support both Windows and Linux operating
systems. Payloads are delivered via phishing email or third party framework
(e.g., Empire, Metasploit, Cobalt Strike). The use of malicious torrent files
has also been observed as a delivery vector for BlackSuit ransomware.

Command line parameters supported by BlackSuit ransomware:

-p {target path} Target path -killvm Termination of vmware via esxcali command
syntax -allfiles Encrypt all files -network Encrypt connected and available
network volumes -local Encrypt local volumes only (no network spreading)
-percent Encrypt percentage (incremental file encryption option for performance)
-demonoff Display logs -list {file} Supply test file list of inclusions for
encryption -delete Toggle self-deletion feature -thrcount and performance
Specify specific thread count, assist when discerning between x86 or x64
targeting -skip {file} Supply text file of paths to exclude from encryption
-noprotect No PID check, can allow multiple instances of the encryptor to run

 

BlackSuit payloads, on both Windows and Linux, utilize OpenSSL’s implementation
of AES for data encryption, which supports the intermittent encryption options
(-percent option). Linux payloads have the ability to target and manipulate
VMWare ESXi servers, via the -killvm option, for example. This parameter is tied
to the esxcli process:







Observed esxcli commands include:

"esxcli vm process list > list_"

"esxcli vm process kill --type=soft --world-id=%s"

"esxcli vm process kill --type=soft --world-id=%s"

"esxcli vm process list > PID_list_"

 

BlackSuit encryption is extremely rapid. Local logical drive details are
obtained upon launch at which time the ransomware will very quickly process
through available files and folders on all reachable volumes.

On Windows systems, the ransomware will attempt to inhibit system recovery by
removing Volume Shadow Copies (VSS). This is handled via a hidden shell command
which launches VSSADMIN.EXE with the /ALL and /Quiet options.













BlackSuit ransom notes are written to all folders which contain encrypted items.
The ransom notes are written as “README.BlackSuit.txt”.







This is only slightly varied on the Linux variants of BlackSuit. The ransom
notes on Linux instances will be written to targeted folders as
“README.blacksuit.txt”, noting the change in capitalization.








HOW TO DETECT BLACKSUIT RANSOMWARE

The SentinelOne Singularity XDR Platform can identify and stop any malicious
activities and items related to BlackSuit ransomware.







In case you do not have SentinelOne deployed, detecting BlackSuit ransomware
requires a combination of technical and operational measures designed to
identify and flag suspicious activity on the network. This allows the
organization to take appropriate action, and to prevent or mitigate the impact
of the ransomware attack.

To detect BlackSuit ransomware without SentinelOne deployed, it is important to
take a multi-layered approach, which includes the following steps:

 1. Use anti-malware software or other security tools capable of detecting and
    blocking known ransomware variants. These tools may use signatures,
    heuristics, or machine learning algorithms, to identify and block suspicious
    files or activities.
 2. Monitor network traffic and look for indicators of compromise, such as
    unusual network traffic patterns or communication with known
    command-and-control servers.
 3. Conduct regular security audits and assessments to identify network and
    system vulnerabilities and ensure that all security controls are in place
    and functioning properly.
 4. Educate and train employees on cybersecurity best practices, including
    identifying and reporting suspicious emails or other threats.
 5. Implement a robust backup and recovery plan to ensure that the organization
    has a copy of its data and can restore it in case of an attack.


HOW TO MITIGATE BLACKSUIT RANSOMWARE

The SentinelOne Singularity XDR Platform can return systems to their original
state using either the Quarantine or Repair.







In case you do not have SentinelOne deployed, there are several steps that
organizations can take to mitigate the risk of BlackSuit ransomware attacks:

Educate employees: Employees should be educated on the risks of ransomware, and
on how to identify and avoid phishing emails, malicious attachments, and other
threats. They should be encouraged to report suspicious emails or attachments,
and to avoid opening them, or clicking on links or buttons in them.

Implement strong passwords: Organizations should implement strong, unique
passwords for all user accounts, and should regularly update and rotate these
passwords. Passwords should be at least 8 characters long, and should include a
combination of uppercase and lowercase letters, numbers, and special characters.

Enable multi-factor authentication: Organizations should enable multi-factor
authentication (MFA) for all user accounts, to provide an additional layer of
security. This can be done through the use of mobile apps, such as Google
Authenticator or Microsoft Authenticator, or through the use of physical tokens
or smart cards.

Update and patch systems: Organizations should regularly update and patch their
systems, to fix any known vulnerabilities, and to prevent attackers from
exploiting them. This includes updating the operating system, applications, and
firmware on all devices, as well as disabling any unnecessary or unused services
or protocols.

Implement backup and disaster recovery: Organizations should implement regular
backup and disaster recovery (BDR) processes, to ensure that they can recover
from ransomware attacks, or other disasters. This includes creating regular
backups of all data and systems, and storing these backups in a secure, offsite
location. The backups should be tested regularly, to ensure that they are
working, and that they can be restored quickly and easily.

BlackSuit Ransomware: In-Depth Analysis, Detection, and Mitigation
 * BlackSuit Ransomware: In-Depth Analysis, Detection, and Mitigation
 * What Is BlackSuit Ransomware?
 * What BlackSuit Ransomware Target?
 * How Does BlackSuit Ransomware Work?
 * How to Detect BlackSuit Ransomware
 * How to Mitigate BlackSuit Ransomware


EXPERIENCE THE WORLD’S MOST ADVANCED CYBERSECURITY PLATFORM

See how our intelligent, autonomous cybersecurity platform harnesses the power
of data and AI to protect your organization now and into the future.

Request a Demo
©2024 SentinelOne, All Rights Reserved.
Privacy Notice Master Subscription Agreement
Company
 * Our Customers
 * Why SentinelOne
 * Platform
 * About
 * Partners
 * Support
 * Careers
 * Legal & Compliance
 * Security & Compliance
 * Contact Us
 * Investor Relations

Resources
 * Blog
 * Labs
 * Product Tour
 * Press
 * News
 * FAQ
 * Resources
 * Ransomware Anthology

Global Headquarters

444 Castro Street
Suite 400
Mountain View, CA 94041

+1-855-868-3733

sales@sentinelone.com

Sign Up For Our Newsletter
*




Subscribe
By clicking Subscribe, I agree to the use of my personal data in accordance with
SentinelOne Privacy Notice. SentinelOne will not sell, trade, lease, or rent
your personal data to third parties. This site is protected by reCAPTCHA and the
Google Privacy Policy and Terms of Service apply.
Thank you! You will now receive our weekly newsletter with all recent blog
posts. See you soon!
Language
English
 * English
 * 日本語
 * Deutsch
 * Español
 * Français
 * Italiano
 * Dutch
 * 한국어







PRIVACY PREFERENCE CENTER

When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information
Allow All


MANAGE CONSENT PREFERENCES

FUNCTIONAL COOKIES

Always Active

These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages. If you do not allow these cookies then some
or all of these services may not function properly.

STRICTLY NECESSARY COOKIES

Always Active

These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms. You can set your browser to block
or alert you about these cookies, but some parts of the site will not then work.
These cookies do not store any personally identifiable information.

PERFORMANCE COOKIES

Always Active

These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site. All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.

TARGETING COOKIES

Always Active

These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites. They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.

Back Button Back



Vendor Search Search Icon
Filter Icon

Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

Confirm My Choices


We'd like to show you notifications for the latest news and updates.


AllowCancel