ANATOMY OF AN ATTACK: THE "BLACKSUIT BLITZ" AT A GLOBAL EQUIPMENT MANUFACTURER

Summary from the TLDR InfoSec newsletter

Unit 42 assisted a manufacturer targeted by Ignoble Scorpius (BlackSuit ransomware) after attackers used voice phishing to steal VPN credentials, then executed DCSync attacks to compromise domain controllers and exfiltrate 400GB of data before deploying ransomware across 60 VMware ESXi hosts. The incident response strategy involved rapidly expanding Cortex XDR visibility from 250 to 17,000 endpoints and using automated containment through Cortex XSOAR to stop lateral movement, while implementing critical defenses including MFA enforcement, network segmentation, and EFSRPC blocking. Security professionals should prioritize proactive multi-layered defenses, including robust endpoint visibility, automated response capabilities, and strict access controls, as this case demonstrates how a single compromised credential can escalate to a $20 million ransom demand without proper preventive measures.