In this line of work, I am often asked if law enforcement is ever successful in finding and punishing the threat actors who have wreaked havoc on U.S. businesses and stolen millions of dollars in ransomware attacks. I am so pleased to report that—although few and far between, and very difficult to accomplish—there are wins, including a recent one against BlackSuit (Royal).

On August 11, 2025, the U.S. Attorney’s Office for the District of Columbia (DC USAO) announced that, through a coordinated law enforcement effort, the BlackSuit (Royal) ransomware gang was successfully disrupted with the takedown of four servers and nine domains.

According to the DC USAO:

The takedown was conducted by the Department of Homeland Security’s Homeland Security Investigations (HSI), the U.S. Secret Service, IRS Criminal Investigation (IRS-CI), the FBI, and international law enforcement from the United Kingdom, Germany, Ireland, France, Canada, Ukraine, and Lithuania. These actions include the unsealing of a warrant for the seizure of virtual currency valued at $1,091,453 at the time of the seizure.

A previous joint Cybersecurity Advisory issued by the FBI and the Cybersecurity & Infrastructure Security Agency (CISA) details that BlackSuit (Royal) ransomware attacks have targeted “critical infrastructure sectors including, but not limited to, critical manufacturing, government facilities, healthcare and public health, and commercial facilities” and described the tactics, techniques, and procedures (TTPs) used and indicators of compromise (IOCs) to help organizations protect against ransomware.” This coordinated accomplishment is a credit to the law enforcement agencies that continue to hunt these organized cybercriminal gangs and give us a glimmer of hope that efforts to bring these criminals to justice will continue to be successful.