The BlackSuit Ransomware Attack on IT Luggage

The BlackSuit ransomware gang has attacked IT Luggage. IT Luggage is a prominent and well-established luggage brand known for its wide range of travel products and accessories. Over the years, the company has built a reputation for delivering quality and functional luggage solutions to meet the needs of travelers worldwide. The brand offers a diverse selection of luggage options, including suitcases, carry-on bags, duffel bags, and travel accessories. IT Luggage is recognized for incorporating innovative features and materials in its designs to enhance durability, ease of use, and overall travel convenience.

BlackSuit posted IT Luggage to its data leak site on July 25th, leaking "a large amount of data".

Similarities to Royal Ransomware

BlackSuit ransomware exhibits similarities to Royal ransomware. Previous reports have been made on the Windows and Linux variants of Royal. Similar to Royal, BlackSuit is known for targeting both Windows and Linux systems. The YARA rules for the Linux variant of BlackSuit also match samples of the Royal Linux variant. It has been stated that Royal and BlackSuit share 98% similarity in function, 99.5% similarity in blocks, and 98.9% similarity in jumps based on the BinDiff comparison tool.

Although BlackSuit utilizes command line arguments that function similarly to those used by Royal, the strings employed in the arguments differ. Moreover, BlackSuit uses extra arguments not present in Royal ransomware.

Regarding the 32-bit Windows variants of BlackSuit and Royal ransomware families, researchers noted 93.2% similarity in functions, 99.3% similarity in basic blocks, and 98.4% in jumps based on BinDiff. While BlackSuit and Royal Windows variants use different argument strings, the purposes of these arguments are similar.

Both BlackSuit and Royal utilize OpenSSL's AES for encryption and leverage comparable intermittent encryption techniques for fast and efficient encryption of victim files. Once the files are encrypted on a victim machine, BlackSuit appends the .blacksuit extension to encrypted files and presents its ransom note. The ransom note contains the ransomware's TOR chat site and a unique ID for each affected victim.

BlackSuit threat actors employ a leaks site and a double extortion model, demanding ransom for unlocking files and not leaking stolen information.