Anatomy of an Attack: The "Black Suit Blitz" at a Global Equipment Manufacturer
Summary: Unit 42 described a BlackSuit ransomware attack by Ignoble Scorpius on a global equipment manufacturer that began with a vishing call impersonating the IT help desk, which tricked an employee into entering legitimate VPN credentials on a phishing site. The attackers ran a DCSync attack to steal privileged credentials, moved laterally via RDP and SMB, deployed AnyDesk and a custom RAT on a domain controller, extracted the NTDS.dit password database, exfiltrated over 400 GB with a renamed rclone, and used Ansible to encrypt hundreds of virtual machines across roughly 60 VMware ESXi hosts.
Key Takeaway: One set of VPN credentials obtained through a single phone call ended with hundreds of encrypted VMs across about 60 ESXi hosts and more than 400 GB of data gone - the entire operational footprint, not a single system.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026