US, Allies Seize $1 Million Bitcoin, Servers From Russian Ransomware Gang

In a coordinated international operation on July 24, 2025, U.S. authorities and allied law enforcement agencies from Canada, Germany, Ireland, France, the U.K., and others dismantled key infrastructure linked to a Russian ransomware group responsible for the BlackSuit and Royal malware. The operation resulted in the seizure of four servers, nine domains, and approximately $1 million in bitcoin, which had been frozen since January 2024. This cybercriminal network has targeted over 450 U.S. organizations across critical sectors, including healthcare, education, energy, government, and public safety, collecting more than $370 million in ransom payments since 2022. The group demanded over $500 million in total ransom, with the largest individual demand reaching $60 million. U.S. officials emphasized that the ransomware gang's persistent attacks on critical infrastructure pose a serious threat to national security and public safety, highlighting a disruption-first approach by prosecutors to prevent further attacks. Agencies involved in the takedown included the Department of Justice, Homeland Security Investigations, the Secret Service, IRS Criminal Investigation, and the FBI.