US and international law enforcement agencies have taken down servers and websites linked to the BlackSuit ransomware group and seized $1 million in crypto.
News
The US has seized servers, domain names, and around $1 million in crypto assets from the ransomware group BlackSuit.
The Justice Department on Monday that multiple US and international law enforcement agencies conducted an operation against the BlackSuit ransomware groups in late July.
The operation included the unsealing of a warrant for the seizure of cryptocurrency valued at just over $1 million, at the time of the seizure, it .
“Disrupting ransomware infrastructure is not only about taking down servers, it’s about dismantling the entire ecosystem that enables cybercriminals to operate with impunity,” added Michael Prado, Deputy Assistant Director at the Homeland Security Investigations Cyber Crimes Center.
Blacksuit is a spinoff of the Royal ransomware gang and has operated since at least 2023, with the latest coming amid other actions the US has taken against ransomware groups, such as sanctioning the ransomware hosting in July.
The Justice Department said the takedown was led by the US Department of Homeland Security’s Homeland Security Investigations with help from the Secret Service, the IRS and the FBI, along with law enforcement from the UK, Germany, Ireland, France, Canada, Ukraine, and Lithuania.
Coordinated ransomware attacks
The Justice Department said the group persistently targeted critical infrastructure across sectors, including healthcare, government facilities, manufacturing, and commercial facilities. Victims are typically forced to pay ransoms in Bitcoin () through darknet websites.
Since 2022, BlackSuit has compromised over 450 known victims in the US and has received more than $370 million in ransom payments, it added.
The ransomware schemes used double-extortion tactics such as encrypting victims’ systems while threatening to leak stolen data to further coerce payment, the DOJ stated.
“The BlackSuit ransomware gang’s persistent targeting of US critical infrastructure represents a serious threat to US public safety,” said Assistant Attorney General for National Security John Eisenberg.
Bitcoin ransom seized
In 2023, a victim paid a ransom of 49.3 BTC, worth around $1.4 million at the time, to decrypt their data.
A portion of the ransom payment, the seized $1 million, was repeatedly deposited and withdrawn from a crypto exchange account until the funds were frozen by the exchange in early 2024, it reported, though it did not name the exchange.
Related:
Ransom demands have typically ranged from approximately $1 million to $10 million in BTC, and the largest ransom demanded by BlackSuit actors was $60 million, to the Cybersecurity and Infrastructure Security Agency.
Crypto ransomware successors crop up
In July, the Dallas, Texas, FBI of 20 BTC valued at around $2.4 million from a cryptocurrency address belonging to a prominent member of the Chaos ransomware group.
Last week, analysts at TRM Labs how a new ransomware group called Embargo may have emerged as a successor operation to , which launders proceeds through crypto accounts. Approximately $18.8 million worth remains dormant in unattributed wallets, it revealed.
Magazine:
