BlackSuit Ransomware Network Dismantled $1M Crypto Seized

A US-led task force dismantled the BlackSuit ransomware network in late July. Agencies involved included the DOJ, HSI, FBI, Secret Service and IRS, along with partners from the UK, Germany, Ireland, France, Canada, Ukraine and Lithuania. The operation seized servers, websites and about $1 million in crypto. Active since 2023 as a successor to Royal ransomware, BlackSuit ransomware attacked over 450 healthcare, manufacturing and government targets. It used double extortion tactics—encrypting files and threatening data leaks—to demand ransoms between $1 million and $10 million per incident, and once sought $60 million. Authorities traced a single victim payment of 49.3 BTC (about $1.4 million), froze $1 million on a crypto exchange, and say the group has collected more than $370 million in Bitcoin ransoms. Officials warn that ransomware operations often rebrand and remain vigilant for BlackSuit’s possible resurgence. Separately, India’s Enforcement Directorate froze roughly ₹42.8 crore (about $4.8 million) in assets tied to a crypto scam.