US-Led Global Takedown Seizes $1M, Disrupts BlackSuit Ransomware Gang

The U.S. Department of Justice, in collaboration with a global law enforcement coalition, has announced a significant disruption of the BlackSuit ransomware gang. The operation resulted in the seizure of the gang's servers and approximately $1 million in cryptocurrency, striking a major blow against the cybercriminal organization known for targeting critical infrastructure.

Key Takeaways

• Server and Domain Seizures: Four servers and nine domains associated with BlackSuit were seized on July 24.

• Cryptocurrency Confiscation: Approximately $1 million in bitcoin was recovered from a frozen digital currency exchange account.

• International Cooperation: The operation involved law enforcement agencies from the U.S., Canada, Germany, Ireland, France, the U.K., Ukraine, and Lithuania, along with Europol and Bitdefender.

• BlackSuit's Impact: The gang, also known as Royal, is believed to be responsible for compromising over 450 victims in the U.S. since 2022, including sectors like healthcare, education, and government.

• Financial Gains: BlackSuit and Royal have collectively earned over $370 million in ransom payments since 2022, with individual ransom demands reaching as high as $60 million.

BlackSuit's Reign of Terror

The BlackSuit ransomware gang, which emerged in May 2023 and is believed to be a rebrand of the Royal ransomware gang, has been a persistent threat to U.S. critical infrastructure. Assistant Attorney General for National Security John A. Eisenberg highlighted the serious threat BlackSuit posed to U.S. public safety due to its targeting of essential services.

Homeland Security Investigations estimates that BlackSuit, and its predecessor Royal, have impacted more than 450 victims across the United States. These victims span crucial sectors including healthcare, education, public safety, energy, and government. The gang's financial activities are substantial, with total ransom demands exceeding $500 million USD and individual demands reaching up to $60 million.

Operation Checkmate

The coordinated international effort, dubbed "Operation Checkmate," successfully dismantled key aspects of BlackSuit's infrastructure. The seizure of servers and domains, along with the cryptocurrency, represents a significant victory for law enforcement in combating cybercrime. The recovered bitcoin was traced to a digital currency exchange account that had been frozen earlier in the year.

The Evolving Threat Landscape

Despite this successful operation, security researchers caution that ransomware gangs often rebrand and continue their activities. There are indications that some members of the BlackSuit gang may have already transitioned to a new ransomware-as-a-service operation known as Chaos. Cisco Talos researchers have noted similarities in encryption methodology, ransom note structure, and toolsets between BlackSuit and Chaos, suggesting a likely continuation of their illicit activities under a new guise.

This ongoing evolution underscores the persistent challenge law enforcement faces in eradicating ransomware threats, as cybercriminals adapt and re-emerge with new tactics and identities.

Sources

• US government seized $1M from Russian ransomware gang, TechCrunch.

• BlackSuit ransomware gang taken down, $1M in crypto seized, Axios.

• BlackSuit ransomware gang loses servers, domains, $1m • The Register, The Register.

• BlackSuit Ransomware Group’s Dark Web Sites Seized, Infosecurity Magazine.