From Royal to BlackSuit: How a Ransomware Rebrand Reshaped Them

Description

This intelligence report analyzes the evolution of the Russian-speaking ransomware group Royal as it rebranded to BlackSuit. The transition involved a shift from prioritizing data exfiltration to focusing more on encryption. The group's journey from 2022 to 2025 is detailed, including their tactics, tools, and internal struggles. BlackSuit's toolkit is extensively examined, featuring both proprietary malware and commercial tools. The report highlights the group's sophisticated approach, including the development of custom Command and Control frameworks and the use of advanced stealers. The rebranding process revealed critical characteristics of the group and shaped their future campaigns.