Anatomy of an Attack: The "BlackSuit Blitz" at a Global Equipment Manufacturer

Unit 42 describes a major ransomware incident at a global equipment manufacturer, orchestrated by Ignoble Scorpius, the group behind BlackSuit ransomware. The attack began with a voice phishing call in which the attacker tricked an employee into providing VPN credentials on a phishing site, granting initial access before privilege escalation.

A DCSync attack on a domain controller enabled the theft of highly privileged credentials, after which the actors moved laterally using RDP and SMB and mapped the network with tools such as Advanced IP Scanner and SMBExec. Persistence was established via AnyDesk and a custom RAT on a domain controller, and a second domain controller was compromised to exfiltrate the NTDS[.]dit database containing password hashes, with over 400 GB of data exfiltrated using a renamed rclone.

To cover their tracks, CCleaner was deployed before BlackSuit encrypted hundreds of virtual machines across about 60 VMware ESXi hosts, orchestrated through Ansible. According to Unit 42, the organisation expanded its Cortex XDR deployment from 250 to over 17,000 endpoints and negated a $20 million ransom. Published 14 October 2025.