Blacksuit

Inactive

184 Victims

Jun 12, 2023 First Discovered

May 29, 2025 Last Discovered

521 Days Inactive

0% Infostealer

0/1 Sites Online

Known Locations (1)

This Site Has Been Seized

weg7sdx54bevnvulapqu6bpzwztryeflq3s23tegbmnhkbpqz637f2yd.onion

Tools Used

CredentialTheft

AccountRestore, Mimikatz, NirSoft Dialupass, NirSoft IEPassView (iepv), NirSoft MailPassView, NirSoft Netpass, NirSoft RouterPassView

DefenseEvasion

Eraser, GMER, Inno Setup, PowerTool, VirtualBox

DiscoveryEnum

AdFind, Advanced IP Scanner, SharpHound, SharpShares, SoftPerfect NetScan

Exfiltration

7-Zip, Bublup, RClone, Temp[.]sh

LOLBAS

NTDS Utility (ntdsutil), PowerShell, PsExec, WMIC, attrib

Networking

Chisel, Cloudflared, OpenSSH

Offsec

Brute Ratel C4, Cobalt Strike, Rubeus

RMM-Tools

AnyDesk, Atera, LogMeIn, MobaXterm

Intelligence

📄 1 Ransom Notes
View the actual ransom notes used by this group →

Victims (184)

Detailed victim list temporarily unavailable

This group has 184 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.