iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
U.S. authorities say a July 24, 2025, operation took down four servers and nine domains tied to BlackSuit ransomware. The Department of Justice announced the action on August 11, 2025. Homeland Security Investigations (HSI) has estimated that Royal and BlackSuit compromised more than 450 known U.S. victims since 2022; that is an agency estimate, not a verified total published in the DOJ release.
When did the BlackSuit ransomware takedown happen?
The infrastructure seizure occurred on July 24, 2025, and the U.S. Department of Justice announced it on August 11. The coordinated action took down four servers and nine domains. The difference matters: the operational action was in July, while the public announcement came in August. The DOJ announcement describes the group as “BlackSuit (Royal).”
How many U.S. victims did Royal and BlackSuit hit?
HSI is reported as estimating more than 450 known victims in the United States since 2022. Treat that as a cumulative estimate attributed to HSI, not a confirmed count or a figure stated by DOJ in its release. HSI’s linked announcement could not be directly verified, so the estimate should not be read as a complete tally of every affected organization.
Recommended Free Tools
What did authorities seize?
DOJ reported that authorities seized virtual currency valued at $1,091,453 at the time of seizure. That is the historical valuation reported in the 2025 announcement, not the currency’s current value.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
The figure is distinct from the ransom demands described in the FBI and CISA advisory updated August 7, 2024. That advisory says demands typically ranged from approximately $1 million to $10 million, with more than $500 million in total demands and a largest individual demand of $60 million. Those are reported demands, not confirmed payments or proceeds. The advisory also says payment was demanded in Bitcoin. Read the FBI and CISA advisory.
Is BlackSuit the same group as Royal ransomware?
Federal sources connect the names: DOJ calls it “BlackSuit (Royal),” and the FBI/CISA advisory’s version history records that its title changed from Royal Ransomware to BlackSuit Ransomware in August 2024. Use BlackSuit (Royal) when referring to the group across that period. The 2025 seizure disrupted infrastructure; it does not establish that every related actor or successor operation has ended.
Rank #2
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
How did BlackSuit attack organizations?
The 2024 FBI/CISA advisory describes a double-extortion pattern: attackers exfiltrated data, encrypted systems, and threatened to publish stolen information if victims did not pay. Reported initial access routes included phishing, compromised Remote Desktop Protocol (RDP), and vulnerable internet-facing applications. The advisory also describes lateral movement inside victim networks and attempts to disable antivirus protections.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
These are agency observations published in 2024, not a guarantee that every incident followed the same sequence. The advisory includes technical indicators that may become outdated; it warns that some observed IP addresses are several years old and should be vetted before being used for current blocking decisions.
Rank #3
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
What should an organization do after a ransomware attack?
- Report the incident. The FBI and CISA recommend reporting to the FBI’s Internet Crime Complaint Center (IC3), a local FBI field office, or CISA.
- Do not treat payment as a recovery guarantee. The agencies say payment does not guarantee that files will be recovered and may encourage further criminal activity.
- Strengthen access controls. Enable and enforce multifactor authentication, ideally phishing-resistant MFA, and prioritize known exploited vulnerabilities.
- Reduce the chance of another entry. Train users to recognize phishing and address exposed services and vulnerable public-facing applications.
FIDO2 security keys are one possible way to implement phishing-resistant MFA; the advisory recommends the security practice, not a particular product or brand.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What does the takedown mean—and what does it not mean?
The operation removed specific infrastructure and seized cryptocurrency, according to DOJ. It is a meaningful disruption, but those actions alone do not show that victims recovered encrypted files, that every operator was arrested, or that related activity cannot resume using replacement infrastructure. DOJ quoted Assistant Attorney General John A. Eisenberg calling the group’s targeting of U.S. critical infrastructure a serious public-safety threat. The seizure should therefore be understood as an enforcement action against identified infrastructure, not proof that the ransomware risk has disappeared.
Quick Recap
Best Value
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Rank #4
- SonicWall Advanced Protection Service Suite for NSA3700 - 3 Year License (02-SSC-6910)
- Capture ATP with RTDMI for Enterprise: Defend against zero-day exploits and ransomware using multi-engine cloud sandboxing and advanced memory inspection.
- Full Threat Protection Stack: Includes Gateway AV, Intrusion Prevention, Anti-Spyware, Application Control, and Content Filtering for layered defense.
- 24x7 Global Support & Firmware Updates: Keep your firewall protected and operational with continuous technical assistance and critical firmware upgrades.
- Application Intelligence & Network Control: Identify and control network activity with deep traffic analytics and reporting features.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
