BlackSuit Ransomware Breaches Corporate Network Using Single Compromised VPN Credential

A major manufacturing company fell victim to a swift and devastating ransomware attack after threat actors gained access using just one set of stolen VPN credentials, with the incident attributed to the cybercrime group Ignoble Scorpius. According to Unit42, the breach began with a deceptive voice phishing call that convinced an employee to hand over VPN login details, allowing the intruders to elevate privileges, run a DCSync attack on a domain controller, and move through the network via Remote Desktop and SMB.

They installed AnyDesk and a custom remote access Trojan for persistence, compromised a second domain controller exposing the NTDS[.]dit password hashes, and siphoned over 400 GB of data using a renamed rclone utility, after wiping logs with CCleaner. The final phase encrypted hundreds of virtual machines across roughly 60 VMware ESXi hosts via BlackSuit ransomware, halting production and prompting a rapid response led by Unit 42; the attackers also orchestrated the attack through Ansible.

The manufacturer rejected a $20 million ransom demand, and guidance following the incident included mandating multi-factor authentication for all remote logins and replacing outdated Cisco ASA firewalls with next-generation solutions to improve segmentation and restrict management access.