The BlackSuit ransomware, for most of its existence, went under the radar and is rarely talked about. The cybercriminal group has conducted ransomware attacks, targeting schools in central Georgia and a zoo in Tampa Bay.

The DePauw University in Indiana also fell victim, with a “limited amount of data on specific individuals” compromised. The group posted 214GB of stolen data on their dark web extortion site. Emerging in May 2023, BlackSuit appears linked to the Royal and Conti ransomware gangs.

The US Department of Health and Human Services (HHS) warned healthcare sectors about BlackSuit’s similarities to Royal and its status as Conti’s successor, emphasizing it as a significant threat. BlackSuit encrypts files on Linux and Windows systems, appends “.blacksuit” to affected files, alters desktop wallpaper, and leaves a ransom note named “README.BlackSuit.txt”.