U.S. Authorities Seize Servers and $1.09 Million in Cryptocurrency from BlackSuit Ransomware Group

The U.S. government is intensifying its efforts against cybersecurity threats as it targets the BlackSuit ransomware gang. This group, active since 2022, has been linked to over $370 million in ransom demands, and has now been dealt a significant blow with the seizure of servers and cryptocurrency.

Key Takeaways

The U.S. Justice Department seized four servers, nine domains, and approximately $1.09 million in cryptocurrency from the BlackSuit ransomware gang.
BlackSuit is a spinoff of the Royal ransomware group and has targeted various organizations, demanding ransoms ranging from $1 million to $60 million.
This operation involved collaboration with agencies from the U.S. and several other countries, enhancing the fight against cybercrime on a global scale.
Authorities have indicated that BlackSuit has compromised over 450 victims in the U.S. since its inception.

U.S. seizes servers and $1.09m in crypto linked to BlackSuit ransomware gang

Crackdown on Cybercrime: The Case of BlackSuit

U.S. authorities have turned their attention to another ransomware group, the BlackSuit gang, which has been in operation since 2022 and is associated with more than $370 million in ransom demands. On Monday, the Justice Department announced the seizure of four servers, nine domains, and around $1.09 million in cryptocurrency connected to BlackSuit. This operation was executed in collaboration with both U.S. and international partners.

The raid took place on July 24 and involved a wide range of agencies, such as Homeland Security Investigations, the Secret Service, IRS Criminal Investigation, and the FBI, alongside law enforcement from the United Kingdom, Germany, Ireland, France, Canada, Ukraine, and Lithuania. Authorities also unsealed a federal warrant for the seized cryptocurrency, which had been frozen earlier this year by an unidentified exchange.

BlackSuit, which emerged as a spinoff of the Royal ransomware gang, adopted its name in 2023, continuing to employ many of the tactics, techniques, and tools associated with its predecessor. The group has gained notoriety within the cybercrime community for targeting large organizations with ransom demands ranging from $1 million to $10 million, with one instance reportedly demanding as much as $60 million.

Operating a portal on the dark web, BlackSuit listed sensitive stolen data which it threatened to release publicly if victims failed to meet its ransom demands. As of late 2023, the FBI and the Cybersecurity and Infrastructure Security Agency issued a joint advisory warning that BlackSuit had the capability to attack sectors where disruptions could be most impactful.

Within the U.S., BlackSuit has targeted critical infrastructure, predominantly healthcare providers, government facilities, manufacturing plants, and commercial operators. Victims often found themselves locked out of essential systems while facing the imminent threat of data leaks. In 2023, one unnamed organization reportedly paid 49.3 Bitcoin—equivalent to around $1.44 million at the time—to regain control of its systems following a BlackSuit breach, with a portion of this ransom payment contributing to the $1.09 million seized during the takedown after extensive investigations.

Authorities estimate that since its formation, BlackSuit has compromised over 450 known victims in the U.S. The United States has been engaged in a comprehensive campaign against ransomware attacks, employing sanctions and enforcement actions. This was described in the recent announcement as a “disruption-first” strategy.

As covered earlier by crypto.news, the U.S., UK, and Australia had previously sanctioned the Russian hosting provider Zservers for facilitating bulletproof hosting for the LockBit ransomware gang. Additionally, last month, the Justice Department initiated a forfeiture action aimed at recovering $2.3 million in Bitcoin from a member of the Chaos ransomware group, following the FBI's Dallas division seizing 20 BTC from a Chaos-associated address during the same month.