BlackSuit Ransomware Group Dismantled After Extorting $370M from 450+ U.S. Victims A globally coordinated law enforcement operation has dismantled the infrastructure of BlackSuit, a Russian-linked ransomware group responsible for extorting over $370 million from more than 450 U.S. victims since 2022. The takedown, led by Homeland Security Investigations (HSI) and international partners, targeted the group’s servers, domains, and tools used for ransomware deployment, extortion, and money laundering. BlackSuit, which evolved from the Conti ransomware collective after its 2022 breakup, primarily targeted healthcare, education, public safety, energy, and government sectors. German officials identified 184 BlackSuit victims, while U.S. agencies reported the group’s extortion demands exceeded $500 million by August 2024. The majority of its victims were based in the U.S., prompting warnings from officials about threats to critical infrastructure. The group’s leak site was seized on July 24, though U.S. authorities delayed public confirmation for two weeks. While the takedown disrupted BlackSuit’s operations, cybersecurity researchers note its impact may be limited, as affiliates had already shifted to INC ransomware and abandoned the BlackSuit brand before the operation. BlackSuit’s origins trace back to Conti’s dissolution, with former members rebranding under subgroups like Zeon, Black Basta, and Quantum before settling on Royal and later BlackSuit in 2024. Despite its high-profile attacks, the group’s activity had declined since December 2023 ahead of the takedown.