U.S. government seized $1 million from Russian ransomware gang

In a significant move against cybercrime, the U.S. Department of Justice declared on Monday that it has successfully confiscated $1 million in bitcoin along with servers from the infamous Russian ransomware group associated with the BlackSuit and Royal malware. This operation was executed in collaboration with a coalition of international law enforcement agencies from countries including Canada, Germany, Ireland, France, and the U.K., among others. The seizure occurred on July 24, encompassing four servers and nine domains linked to the operation of this cybercriminal organization. Both BlackSuit and Royal are distinct types of ransomware, yet they are believed to originate from the same group, which has been implicated in attacks on critical infrastructure across the United States and beyond. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), members of the BlackSuit gang have demanded over $500 million in ransom, with the highest single ransom request reaching $60 million. Assistant Attorney General for National Security, John A. Eisenberg, underscored the seriousness of the threat posed by the BlackSuit ransomware group, indicating that their ongoing attacks on U.S. critical infrastructure jeopardize public safety. The investigation, spearheaded by Homeland Security Investigations (HSI), revealed that the Royal and BlackSuit ransomware variants have targeted over 450 victims in the United States, affecting key sectors such as healthcare, education, public safety, energy, and government. Since 2022, these cybercriminals have amassed more than $370 million through ransom payments. The bitcoin confiscated by authorities was traced back to a digital currency exchange account, which had its funds frozen in January of the previous year. This operation marks a significant step in the ongoing battle against ransomware and cyber threats, demonstrating the commitment of U.S. authorities to counter such malicious activities.