Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Assessment: Ignoble Scorpius, Distributors of Black Suit Ransomware

Summary: Unit 42 reports that BlackSuit ransomware, tracked as Ignoble Scorpius and rebranded from Royal in May 2023, has claimed at least 93 victims globally, with a quarter in construction and manufacturing and victims overwhelmingly based in the United States. The group's initial ransom demand averages about 1.6% of the victim's annual revenue, and the median victim revenue is roughly $19.5 million.

What you should know: A demand pegged at 1.6% of annual revenue means the price scales with the target, so a mid-sized organization with $19.5 million in revenue faces a payout sized to hurt rather than a flat fee. The group's rebrand from Royal resets defender perception even as its tactics continue, which can leave coverage tuned to the old name.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026