Gardaí help US take down ‘serious' cybercriminal gang behind $370m ransom payments

Irish Independent

5 days ago

The Garda National Cyber Crime Bureau joined United States Immigration and Customs Enforcement (ICE) in a 'disruption operation' targeting the Blacksuit Ransomware Group.
Key operational infrastructure, including the dark web leaks page and the victim negotiation site, as well as domains attributed to the international criminal network have been successfully removed.
Other law enforcement agencies including the United States Department of Homeland Security (DHS), US Secret Service, the FBI, as well as Dutch, German, UK and Ukrainian police, and Europol took part in the operation.
According to a Garda press release, the Blacksuit ransomware group are an organised crime gang responsible for the commission of ransomware and other 'serious cyber criminality internationally'.
'The Blacksuit ransomware group emerged in May 2023, as a result of the rebranding of the Royal Ransomware Group,' gardai said, 'itself originating from the Conti Ransomware Group, responsible for a number of serious ransomware attacks internationally.'
The Garda Assistant Commissioner for Organised and Serious Crime said they will continue to work with international law enforcement colleagues and private partners 'to identify, target and disrupt organised crime groups using the infrastructure to carry out ransomware and other forms of cybercrime'.
'Our work to date involving close collaboration with international partners, including this seizure and takedown of key online operational infrastructure will continue as part of our ongoing effort to keep people safe both on an offline.'
According to gardaí, dark web leaks page is a website maintained by a ransomware group on the darknet. It is where they publish the names of victims that refuse to pay a ransom or to engage with them.
A victim negotiation site is another site maintained by the threat actors. This is not generally accessible by the wider public, but is where the victims of a ransomware go to engage and communicate with the offenders.
In the US, authorities there said the operation resulted in the seizures of servers, domains and digital assets used to deploy ransomware, extort victims, and launder proceeds.
ADVERTISEMENT
'Disrupting ransomware infrastructure is not only about taking down servers, it's about dismantling the entire ecosystem that enables cybercriminals to operate with impunity,' said HSI Cyber Crimes Center Deputy Assistant Director Michael Prado.
'This operation is the result of tireless international coordination and shows our collective resolve to hold ransomware actors accountable.'
Since 2022, the Royal and BlackSuit ransomware groups have compromised over 450 known victims in the United States, including entities in the healthcare, education, public safety, energy and government sectors.
Combined, the groups have received more than $370 million in ransom payments, based on present-day valuations of cryptocurrency.
The ransomware schemes used double-extortion tactics — encrypting victims' systems while threatening to leak stolen data to further coerce payment.
'This investigation reflects the full reach of HSI's cyber mission and our commitment to protecting victims — whether they're small businesses, school systems, or hospitals,' said HSI Washington, D.C. acting Special Agent in Charge Christopher Heck.
'We will continue to target the infrastructure, finances and operators behind these ransomware groups to ensure they have nowhere left to hide.'