Criminal Action Taken: State Crime Authority Halts Blacksuit Blackmail Syndicate - Digital Crimes: Authorities in LKA Shut Down Harassment Collective Known as Blacksuit
The Lower Saxony State Criminal Police Office (LKA) has announced the shutdown of the servers of the Blacksuit/Royal ransomware group, marking the culmination of a long-term operation against the global cybercrime group.
The operation, known as Operation Checkmate, involved coordinated law enforcement agencies from multiple countries, including Germany, Europol, the FBI, U.S. Homeland Security Investigations, and others.
The Blacksuit/Royal group caused extensive global damage estimated at over $500 million USD (approximately 430 million EUR) by mid-2024. They had at least 184 confirmed victims worldwide, including some in Germany. Victims spanned multiple sectors, including education, government, healthcare, manufacturing, retail, and IT industries.
The group operated as a ransomware-as-a-service, rebranding from the previous Royal ransomware gang active since 2022 and considered linked to the infamous Conti group. Their attacks involved double extortion, encrypting victim data and simultaneously stealing it. Even if victims restored files, the attackers threatened to leak or sell the stolen information to force ransom payments.
The takedown sent a strong message against cybercrime in the digital space from German and international law enforcement. Several victims in Germany were among the approximately 184 worldwide, contributing to the significant European interest in the operation.
LKA President Thorsten Massinger stated that the operation against the Blacksuit/Royal ransomware group sends a clear message of commitment to combating digital crime.
More details about the investigative success against the Blacksuit/Royal ransomware group will be provided at a press conference today in Hannover at 12:30 PM. Investigative authorities urge victims of ransomware attacks to report incidents to prevent further occurrences.
- The employment policy of law enforcement agencies should emphasize cooperation and coordination across international boundaries, such as demonstrated in Operation Checkmate against the Blacksuit/Royal ransomware group.
- In light of the takedown of the Blacksuit/Royal ransomware group, it is imperative that the community policy of all sectors, including technology and general-news, recognizes the increased threat of cybercrime, particularly ransomware attacks, and implements robust cybersecurity measures to protect against such crimes.
