US Confirms Takedown of BlackSuit Ransomware Behind Attacks on 450+ Organizations

The U.S. Homeland Security Investigations (HSI),coordination with international law enforcement agencies, has successfully dismantled the critical infrastructure of BlackSuit ransomware, marking a significant victory against one of the world’s most dangerous cybercriminal operations.

The coordinated takedown, dubbed Operation Checkmate, has seized servers, domains, and digital assets used to deploy ransomware and extort victims worldwide.

Operation Checkmate represents one of the most comprehensive international law enforcement actions against ransomware infrastructure to date.

The operation involved agencies from nine countries, including the U.S. Secret Service, FBI, Dutch National Police, German State Criminal Police Office, U.K. National Crime Agency, Ukrainian Cyber Police, and Europol. Romanian cybersecurity firm Bitdefender’s Draco Team provided crucial technical expertise and consulting throughout the operation.

The seizure specifically targeted BlackSuit’s dark web extortion portals, which served as the backbone of their criminal enterprise.

These hidden sites were used to publish stolen data, pressure victims into ransom payments, and negotiate directly with compromised organizations. Visitors to the BlackSuit .onion domains are now greeted with official seizure banners from U.S.

Homeland Security Investigations, effectively cutting off the group’s primary means of monetizing their attacks.

Law enforcement agencies confiscated considerable amounts of data during the operation and identified 184 victims, according to German officials.

The coordinated action was executed on July 24, 2025, though authorities initially conducted the seizure without immediate public announcement to minimize the group’s ability to regroup.

BlackSuit Ransomware

The scope of BlackSuit’s criminal operation is staggering in both scale and financial impact. Since 2022, the Royal and BlackSuit ransomware groups have compromised over 450 known victims in the United States alone, targeting critical sectors including healthcare, education, public safety, energy, and government.

Combined, these groups have received more than $370 million in ransom payments based on present-day cryptocurrency valuations.

The group’s extortion demands have typically ranged from $1 million to $10 million, with some reaching as high as $60 million.

Their total extortion demands exceeded $500 million by August 2024. BlackSuit operated as a private ransomware group without relying on affiliates, making it particularly dangerous due to its tight operational control.

The ransomware employed sophisticated double-extortion tactics, first stealing sensitive data before encrypting victims’ systems.

This approach maximized pressure on victims by threatening both data confidentiality and system availability. The group’s malware targeted Windows, Linux, and VMware ESXi environments, using AES-256 encryption and wiping shadow copies to prevent recovery.

BlackSuit and Future Concerns

According to Report, BlackSuit emerged as a direct evolution of the Royal ransomware group, which itself was a successor to the notorious Conti cybercrime syndicate.

The progression began with the Quantum ransomware in January 2022, evolving to Royal in September 2022, and finally rebranding as BlackSuit in May 2023.

Cybersecurity analysis revealed striking similarities between Royal and BlackSuit, with 98% function similarities, 99.5% block similarities, and 98.9% jump similarities.

Despite the successful takedown, security researchers warn that the impact may be limited in the long term. Former BlackSuit members have already demonstrated their ability to rebrand and relaunch operations.

Evidence suggests the group is preparing to operate under a new identity called “Chaos ransomware,” with launch preparations reportedly scheduled for September 2025.

Cisco Talos researchers have identified strong overlaps between Chaos and BlackSuit in encryption methods and tooling.

The FBI has already taken action against the emerging Chaos operation, seizing over $2.3 million in Bitcoin from a cryptocurrency wallet linked to a suspected affiliate known as “Hors”. The 20.289 BTC was traced to attacks targeting Texas companies and seized on April 15, 2025.

While Operation Checkmate represents a significant disruption to BlackSuit’s infrastructure, the persistent nature of these cybercriminal organizations means that continued vigilance and international cooperation will be essential to combat the evolving ransomware threat landscape.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.