US government says BlackSuit and Royal ransomware gangs hit hundreds of major
firms before shutdown

Date:
Fri, 08 Aug 2025 16:26:00 +0000

Description:
The criminals struck more than 450 confirmed victims and extorted more than
$370 million.

FULL STORY

BlackSuit, a ransomware group and a successor to the Royal gang, managed to
compromise 450 organizations in the United States and steal $370 million in
ransom payments, before being dismantled by US law enforcement agents, the US
Department of Homeland Security (DHS) has said. 

A press release published on the US Immigration and Customs Enforcements 
(ICE) website, said ICEs Homeland Security Investigations (its main
investigative arm), in coordination with both US and international law
enforcement agents, successfully dismantled critical infrastructure used by
BlackSuit ransomware. 

The operation resulted in the seizures of servers, domains and digital assets
used to deploy ransomware, extort victims, and launder proceeds, it was said.

No arrests 

The announcement said that since 2022, Royal and BlackSuit ransomware groups
have compromised more than 450 known victims in the United States, including
healthcare, education, public safety, energy, and government sector
organizations. 

These attacks brought them more than $370 in cryptocurrency, based on todays
prices. 

Unfortunately, no one was arrested, and if history taught us anything - these
threat actors will be back sooner rather than later. 

While disrupting the infrastructure is a commendable move and will certainly
make things difficult for the threat actors in the short-term, they will have
no issues reestablishing the hardware, especially with $370 million in their
pocket. 

Previously, the FBI, US Homeland Security, the US Department of Justice 
(DoJ), and other partners, defaced BlackSuits main website, as well as
extortion and data leak sites, in a sting called Operation Checkmate. 

A US Department of Health and Human Services report published in late 
November 2023 said BlackSuit was first spotted in May that year, showing
striking parallels with Royal, the direct successor of the former notorious
Russian-linked Conti operation. 

This operation strikes a critical blow to BlackSuits infrastructure and
operations, said US Secret Service Criminal Investigative Division Special
Agent in Charge William Mancino. 

The US Secret Service is committed to working alongside our law enforcement
partners to dismantle criminal enterprises and prevent the deployment of
malicious ransomware that victimizes businesses and organizations. 

 Via BleepingComputer

======================================================================
Link to news story:
https://www.techradar.com/pro/security/us-gov...
ransomware-gangs-hit-hundreds-of-major-firms-before-shutdown

$$
--- SBBSecho 3.28-Linux
 * Origin: capitolcityonline.net * Telnet/SSH:2022/HTTP (618:250/1)