Sign in Subscribe
Infrastructure (Economics)

U.S. Department of Homeland Security Disrupts BlackSuit Ransomware Infrastructure

Strategic Insights

— 1 min read

The U.S. Department of Homeland Security's Immigration and Customs Enforcement, in close coordination with U.S. and international law enforcement partners, has successfully dismantled critical infrastructure used by BlackSuit ransomware, a major cybercriminal operation. This operation resulted in the seizures of servers, domains, and digital assets used to deploy ransomware, extort victims, and launder proceeds. Since 2022, the Royal and BlackSuit ransomware groups have compromised over 450 known victims in the United States, including entities in the healthcare, education, public safety, energy, and government sectors.

Key Takeaways:

  • The U.S. Department of Homeland Security's Immigration and Customs Enforcement, in coordination with U.S. and international law enforcement partners, has dismantled critical infrastructure used by BlackSuit ransomware.
  • The operation resulted in the seizures of servers, domains, and digital assets used to deploy ransomware, extort victims, and launder proceeds.
  • The BlackSuit ransomware group, a successor to Royal ransomware, has compromised over 450 known victims in the United States since 2022, including entities in the healthcare, education, public safety, energy, and government sectors.
  • The Royal and BlackSuit ransomware groups have received more than $370 million in ransom payments, based on present-day valuations of cryptocurrency.
  • The operation is part of a broader effort to target the infrastructure, finances, and operators behind ransomware groups.
  • The coordinated takedown was conducted under Operation Checkmate, a Europol Joint Cyber Action Task Force-coordinated initiative specifically targeting the Royal and BlackSuit ransomware groups.
  • The U.S. Department of Justice National Security Division's National Security Cyber Section, the U.S. Attorney's Office for the Eastern District of Virginia, and the Justice Department's Office of International Affairs provided valuable assistance to this investigation.

Sources:

  • U.S. Department of Homeland Security's Immigration and Customs Enforcement
  • U.S. Department of Justice National Security Division's National Security Cyber Section
  • Europol Joint Cyber Action Task Force
  • The U.S. Attorney's Office for the Eastern District of Virginia
  • The Justice Department's Office of International Affairs
  • HSI The Hague, HSI Frankfurt, HSI London, HSI Bucharest, and HSI San Diego
  • IRS Criminal Investigation's Cyber Crimes Unit
  • The FBI, Europol, and international law enforcement partners from the United Kingdom's National Crime Agency, Germany's Landeskriminalamt Niedersachsen, Ireland's An Garda Siochana-Garda National Cyber Crime Bureau, Ukraine's National Police of Ukraine-Cyberpolice Department, Lithuania's Criminal Police Bureau, France's Office Anti-Cybercriminalite, and Canada's Royal Canadian Mounted Police and Delta Police Department.

Read more