US Government Confirms Shutdown of BlackSuit Ransomware, Targeting Over 450 Organizations

U.S. authorities have successfully dismantled the BlackSuit ransomware operation, a notorious group responsible for attacks on over 450 organisations globally. This operation, led by Immigration and Customs Enforcement’s (ICE) Homeland Security Investigations (HSI), involved the seizure of servers, domains, and digital assets used for deploying ransomware, extorting victims, and laundering illicit profits. BlackSuit, regarded as the successor to the Royal ransomware group, has been active since 2022, targeting critical sectors such as healthcare, education, public safety, energy, and government. Victims in the U.S. alone have paid more than $370 million in ransoms, often in cryptocurrency, under threats of data encryption and leaks, a tactic known as double extortion. The takedown, named Operation Checkmate, was a collaborative effort involving international partners, including the FBI, Europol, and law enforcement agencies from the UK, Germany, Ireland, Ukraine, Lithuania, France, and Canada.

HSI Cyber Crimes Center Deputy Assistant Director Michael Prado stated that disrupting ransomware infrastructure involves dismantling the entire ecosystem that allows cybercriminals to operate with impunity. He emphasised the importance of international coordination in holding these actors accountable. HSI Washington, D.C., acting Special Agent in Charge Christopher Heck highlighted the agency’s commitment to protecting vulnerable entities, asserting that the investigation reflects HSI’s comprehensive cyber mission. He affirmed that the agency would continue to target the infrastructure, finances, and operators behind ransomware groups to ensure they have nowhere left to hide. Officials from the Department of Justice underscored the national security threat posed by BlackSuit’s attacks on U.S. critical infrastructure. Assistant Attorney General for National Security John A. Eisenberg noted the ongoing collaboration among government agencies to protect the nation from such threats. U.S. Attorney for the Eastern District of Virginia Erik S. Siebert described the action as a “forward-leaning, disruption-first approach” to combating cyber threats, asserting that the protection of U.S. businesses and critical infrastructure remains a top priority. 

Categories: Ransomware Operations, Cybersecurity Enforcement, International Collaboration 

Tags: Ransomware, BlackSuit, Operation Checkmate, Cybersecurity, Extortion, Cryptocurrency, Critical Infrastructure, International Coordination, Law Enforcement, Public Safety