US government says BlackSuit and Royal ransomware gangs hit hundreds of major firms before shutdown

Date:
Fri, 08 Aug 2025 16:26:00 +0000

Description:
The criminals struck more than 450 confirmed victims and extorted more than $370 million.

FULL STORY

BlackSuit, a ransomware group and a successor to the Royal gang, managed to compromise 450 organizations in the United States and steal $370 million in ransom payments, before being dismantled by US law enforcement agents, the US Department of Homeland Security (DHS) has said.

A press release published on the US Immigration and Customs Enforcements
(ICE) website, said ICEs Homeland Security Investigations (its main investigative arm), in coordination with both US and international law enforcement agents, successfully dismantled critical infrastructure used by BlackSuit ransomware.

The operation resulted in the seizures of servers, domains and digital assets used to deploy ransomware, extort victims, and launder proceeds, it was said.

No arrests

The announcement said that since 2022, Royal and BlackSuit ransomware groups have compromised more than 450 known victims in the United States, including healthcare, education, public safety, energy, and government sector organizations.

These attacks brought them more than $370 in cryptocurrency, based on todays prices.

Unfortunately, no one was arrested, and if history taught us anything - these threat actors will be back sooner rather than later.

While disrupting the infrastructure is a commendable move and will certainly make things difficult for the threat actors in the short-term, they will have no issues reestablishing the hardware, especially with $370 million in their pocket.

Previously, the FBI, US Homeland Security, the US Department of Justice
(DoJ), and other partners, defaced BlackSuits main website, as well as extortion and data leak sites, in a sting called Operation Checkmate.

A US Department of Health and Human Services report published in late
November 2023 said BlackSuit was first spotted in May that year, showing striking parallels with Royal, the direct successor of the former notorious Russian-linked Conti operation.

This operation strikes a critical blow to BlackSuits infrastructure and operations, said US Secret Service Criminal Investigative Division Special Agent in Charge William Mancino.

The US Secret Service is committed to working alongside our law enforcement partners to dismantle criminal enterprises and prevent the deployment of malicious ransomware that victimizes businesses and organizations.

Via BleepingComputer

======================================================================
Link to news story: https://www.techradar.com/pro/security/us-government-says-blacksuit-and-royal- ransomware-gangs-hit-hundreds-of-major-firms-before-shutdown

$$
--- SBBSecho 3.28-Linux
* Origin: capitolcityonline.net * Telnet/SSH:2022/HTTP (618:250/1)