US and Allies Seize $1M in Crypto, Take Down BlackSuit Ransomware Infrastructure

Multi-agency operation targets ransomware group linked to Royal gang

US and international law enforcement agencies have dismantled key infrastructure belonging to the BlackSuit ransomware group, seizing servers, domain names, and approximately $1 million in cryptocurrency.

The US Department of Justice (DOJ) announced Monday that the operation, conducted in late July, involved the Department of Homeland Security’s Homeland Security Investigations (HSI), the Secret Service, the IRS, and the FBI, alongside law enforcement from the UK, Germany, Ireland, France, Canada, Ukraine, and Lithuania.

“Disrupting ransomware infrastructure is not only about taking down servers, it’s about dismantling the entire ecosystem that enables cybercriminals to operate with impunity,” said Michael Prado, Deputy Assistant Director at the HSI Cyber Crimes Center.

A Persistent Threat to Critical Infrastructure

BlackSuit, considered a spinoff of the Royal ransomware gang, has been active since at least 2023, targeting sectors including healthcare, government facilities, manufacturing, and commercial operations. The group employs double-extortion tactics, encrypting victims’ data while threatening to leak stolen information unless paid in Bitcoin (BTC).

According to the DOJ, BlackSuit has compromised over 450 known victims in the US since 2022 and collected more than $370 million in ransom payments. Demands have typically ranged from $1 million to $10 million, with the largest known request reaching $60 million.

In one 2023 incident, a victim paid 49.3 BTC — worth about $1.4 million at the time — to regain access to their systems. The seized $1 million was part of this ransom and had been repeatedly deposited and withdrawn from a cryptocurrency exchange until the funds were frozen in early 2024.

“The BlackSuit ransomware gang’s persistent targeting of US critical infrastructure represents a serious threat to US public safety,” said Assistant Attorney General for National Security John Eisenberg.

The takedown follows recent US actions against other ransomware operators, including sanctions on hosting provider Aeza Group in July and the seizure of 20 BTC from a member of the Chaos ransomware group in Texas. Analysts at TRM Labs have also identified Embargo, a suspected successor to BlackCat, with $18.8 million in crypto still dormant in unlinked wallets.

With the DOJ signaling continued global cooperation, the pressure on crypto-powered ransomware operations appears set to intensify.

Disclaimer

This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.