Archive — US — techcrunch
Authorities seize BlackSuit ransomware gang’s servers
German and U.S. authorities have seized the servers of the BlackSuit ransomware gang, implicated in multiple major cyberattacks. This operation captured significant data aimed at identifying the perpetrators and disrupted the gang's operations by shutting down its malware infrastructure. BlackSuit had targeted numerous victims globally, particularly in Germany.
Key points
- A joint operation between German and U.S. authorities led to the seizure of BlackSuit's servers on July 24.
- The operation secured considerable data to help identify those involved in the ransomware attacks.
- BlackSuit had 184 known victims worldwide, impacting various sectors including healthcare and manufacturing.
- The gang's leak site on the dark web now displays a seizure notice, effectively taking it offline.
- The operation involved support from ICE's Homeland Security Investigations and Europol.
- There are indications that Chaos, a new ransomware gang, may consist of former BlackSuit members.
Why it matters
- The seizure of BlackSuit's infrastructure ties into ongoing global efforts to combat cybercrime and ransomware, especially as cyber attacks increase.
- Similar previous operations have succeeded against notorious gangs, highlighting an international collaborative framework in cybersecurity.
- In 2025, the trend of rebranding among ransomware groups remains relevant, emphasizing continuous evolution and adaptation in cybercriminal tactics.
This operation represents a significant step in international law enforcement's battle against ransomware, aiming to dismantle criminal infrastructure and reduce future cyber threats.