Authorities Shut Down Servers Operated by BlackSuit Ransomware Group

Authorities in Germany have announced the successful dismantling of infrastructure associated with the BlackSuit ransomware group, known for its role in numerous major cyberattacks, thanks to a collaborative effort between U.S. and European agencies.

In a statement released this week, German officials confirmed the seizure of the gang’s servers and systems during an operation conducted on July 24. They stated that the operation resulted in the acquisition of “substantial amounts of data,” which will aid in identifying the perpetrators behind the cyberattacks.

Officials reported that the servers were disabled, effectively stopping the ransomware malware. The statement highlighted that BlackSuit had 184 victims worldwide, several of which are located in Germany.

At the time of this publication, BlackSuit’s dark web leak site, used for publishing files and extorting ransom payments from victims, was no longer accessible. It now displays a seizure notice, indicating that the site was taken down as part of a “coordinated international law enforcement investigation.”

According to German officials, the operation was supported by ICE’s Homeland Security Investigations and Europol. ICE representatives have not responded to requests for comments.

Reports suggest that U.S. authorities disclosed the seizure earlier in the week; however, it remains uncertain if any arrests were made.

BlackSuit has become one of the more active ransomware groups recently, targeting U.S. cities like Dallas and organizations in sectors such as manufacturing, communications, and healthcare.

In 2024, the U.S. cybersecurity agency CISA alerted that the group was rebranding from Royal to BlackSuit. It is not unusual for ransomware gangs to evolve or merge with others in an effort to circumvent government-enforced sanctions that hinder profit-making through cybercrimes.

Following this, security researchers identified a new ransomware group called Chaos, believed to consist of former members of the BlackSuit gang.