US and allies seize $1 million from Russian ransomware gang

US cybersecurity officials revealed that the ransomware group demanded over $500 million in total, with a single ransom reaching $60 million, compromising more than 450 US organizations and collecting over $370 million in ransom payments since 2022

In a coordinated international crackdown, the US Department of Justice (DOJ) has dismantled a major Russian cybercrime network linked to the BlackSuit and Royal ransomware strains, seizing servers, domains, and $1 million in cryptocurrency.

The operation, announced on Monday (August 11), was carried out on July 24 with the cooperation of law enforcement agencies from Canada, Germany, Ireland, France, the United Kingdom, and other partner nations. Authorities confirmed the seizure of four servers and nine internet domains used to conduct ransomware operations.

BlackSuit and Royal are distinct ransomware variants widely believed to have been developed and deployed by the same Russian criminal group. The syndicate has been accused of orchestrating large-scale attacks on critical infrastructure in the US and internationally, targeting sectors such as healthcare, education, public safety, energy, and government.

Ransom demands and disruption efforts

US cybersecurity officials previously revealed that the group had demanded more than $500 million in ransoms overall, with a single demand reaching as high as $60 million. According to investigators, the gang has compromised over 450 organizations in the US alone, extracting more than $370 million in ransom payments since 2022.

Assistant Attorney General for National Security John A. Eisenberg described the group’s activities as a “serious threat” to public safety, emphasizing the risks posed to essential services. The Department of Homeland Security’s Homeland Security Investigations (HSI), which led the probe, said the criminal operation displayed a pattern of targeting vital systems with ruthless efficiency.

The $1 million in recovered bitcoin was traced to a cryptocurrency exchange account whose assets were frozen in January 2024. Officials noted that dismantling the gang’s infrastructure would significantly disrupt its ability to launch new attacks, although investigations into associated actors remain ongoing.

The DOJ reiterated its commitment to pursuing ransomware operators globally, vowing to work with allies to curb the growing cybercrime threat.