The US seized servers, domain names and about $1 million in crypto assets from the ransomware group BlackSuit.

The Justice Department said on Monday that multiple US and international law enforcement agencies conducted an operation against the BlackSuit ransomware groups in late July.

The operation included the unsealing of a warrant for the seizure of cryptocurrency valued at just over $1 million at the time, it reported. 

“Disrupting ransomware infrastructure is not only about taking down servers, it’s about dismantling the entire ecosystem that enables cybercriminals to operate with impunity,” said Michael Prado, deputy assistant director at the Homeland Security Investigations Cyber Crimes Center.

BlackSuit is a spinoff of the Royal ransomware gang and has operated since at least 2023, with the latest seizure coming amid other actions the US has taken against ransomware groups, including sanctioning the ransomware hosting provider Aeza Group in July.

The Justice Department said the takedown was led by the US Department of Homeland Security’s Homeland Security Investigations with help from the Secret Service, the IRS and the FBI, along with law enforcement from the UK, Germany, Ireland, France, Canada, Ukraine and Lithuania.

Coordinated ransomware attacks 

The Justice Department said the ransomware group persistently targeted critical infrastructure across sectors, including healthcare, government facilities, manufacturing and commercial facilities. Victims are typically forced to pay ransoms in Bitcoin (BTC) through darknet websites.

Since 2022, BlackSuit has compromised over 450 known victims in the US and has received more than $370 million in ransom payments, it added.

The ransomware schemes used double-extortion tactics such as encrypting victims’ systems while threatening to leak stolen data to further coerce payment, the DOJ said. 

“The BlackSuit ransomware gang’s persistent targeting of US critical infrastructure represents a serious threat to US public safety,” said Assistant Attorney General for National Security John Eisenberg.

Bitcoin ransom seized 

In 2023, a victim paid a ransom of 49.3 BTC, worth around $1.4 million at the time, to decrypt their data. 

A portion of the ransom payment, the seized $1 million, was repeatedly deposited and withdrawn from a crypto exchange account until the funds were frozen by the exchange in early 2024, it reported, though it did not identify the exchange. 

Related: US sanctions crypto wallet tied to ransomware, infostealer host

Ransom demands have typically ranged from about $1 million to $10 million in BTC, and the largest ransom demanded by BlackSuit actors was $60 million, according to the Cybersecurity and Infrastructure Security Agency.

Crypto ransomware successors crop up

In July, the Dallas, Texas, FBI announced the seizure of 20 BTC valued at about $2.4 million from a cryptocurrency address belonging to a prominent member of the Chaos ransomware group.

Last week, analysts at TRM Labs investigated a new ransomware group called Embargo that may have emerged as a successor operation to BlackCat, which launders proceeds through crypto accounts. About $18.8 million worth remained dormant in unattributed wallets, it said. 

Magazine: Scottie Pippen says Michael Saylor warned him about Satoshi chatter