Law enforcement operations seized BlackSuit ransomware gang’s darknet sites
July 26, 2025 
An international law enforcement operation seized the dark web data leak site of the BlackSuit ransomware group.
A banner on the BlackSuit ransomware group’s TOR data leak sites informs visitors that they were seized by U.S. Homeland Security Investigations in a global law enforcement operation. The notice features logos of 17 law enforcement agencies and cybersecurity firm Bitdefender.
The BlackSuit ransomware operation has been active since April 2023. Unlike other RaaS operations, the gang did not manage a network of affiliates. BlackSuit is believed to be a rebrand of Royal ransomware, which the FBI and CISA linked to the Conti cybercrime group, a major player in Russian cybercrime.
In August 2024, FBI and CISA published a joint advisory on the BlackSuit Ransomware group, the advisory includes recent and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) related to BlackSuit operation, which rebrands legacy Royal ransomware, identified by FBI investigations as recent as July 2024. The BlackSuit ransomware targeted various critical infrastructure sectors, including commercial facilities, healthcare, government, and manufacturing. The report is part of the #StopRansomware initiative conducted by the US Government, the advisory, originally published on March 2, 2023, has been updated twice:
- November 13, 2023: The advisory was updated to share new Royal TTPs and IOCs.
- August 7, 2024: The advisory was updated to notify network defenders of the rebrand of “Royal” ransomware actors to “BlackSuit.” The update includes new TTPs, IOCs, and detection methods related to BlackSuit ransomware. “Royal” was updated to “BlackSuit” throughout unless referring to legacy Royal activity. Updates and new content are noted.
The BlackSuit actors gain initial access to victim networks through several methods, including Phishing campaigns, Remote Desktop Protocol (RDP) (Used in about 13.3% of incidents), exploiting vulnerabilities in public-facing applications and using initial access provided by access brokers and harvesting VPN credentials from stealer logs.
Historically, the Royal actors were observed leveraging Chisel, Secure Shell (SSH) client, PuTTY, OpenSSH, and MobaXterm for C2 communications.
The group uses SharpShares and SoftPerfect NetWorx to map out victim networks. They threat actors also use Mimikatz and Nirsoft tools to steal credentials and harvest passwords. Additionally, they often deploy tools like PowerTool and GMER to terminate system processes.
The group exfiltrates data stolen from victim networks using post-exploitation tools, such as Cobalt Strike, and malware such as Ursnif.
BlackSuit actors typically demanded ransoms ranging from $1 million to $10 million USD, with payments in Bitcoin, and have collectively sought over $500 million, with the highest individual demand reaching $60 million. They were open to negotiating payment amounts, which were not specified in the initial ransom note but are discussed via a .onion URL provided after encryption. Recently, there has been an increase in direct communications, such as phone calls or emails, from BlackSuit actors. Like other groups, the gang uses a Tor leak site to publish victim data if the ransom is not paid.
“FBI and CISA encourage organizations to implement the recommendations found in the Mitigations section of this CSA to reduce the likelihood and impact of ransomware incidents.” concludes the report that also provides Indicators of Compromise (IoCs).
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, BlackSuit ransomware)