US Seizes $1 Million in Bitcoin and Related Servers from Russian Ransomware Group

According to ChainCatcher, U.S. and international law enforcement agencies have seized four servers, nine domain names, and approximately $1 million in Bitcoin. These assets are linked to a notorious Russian ransomware group accused of attacking hundreds of institutions across critical sectors.

The U.S. Department of Justice stated that the operation was launched on July 24, jointly conducted by agencies from the United States, Canada, Germany, Ireland, France, the United Kingdom, Ukraine, Lithuania, and others. The operation targeted infrastructure associated with the BlackSuit and Royal ransomware. Investigators believe both ransomware variants were developed by the same cybercriminal group.

Authorities reported that since 2022, the group has extorted over $500 million in ransom payments, with the largest single ransom demand reaching $60 million. During this period, they allegedly attacked more than 450 victims in the United States, including hospitals, schools, police departments, energy companies, and government agencies, illegally profiting at least $370 million.

The cryptocurrency seized in this operation was valued at $1,091,453 at the time of confiscation and originated from a digital wallet frozen by an exchange in January 2024. According to court documents, these funds included part of a Bitcoin ransom payment made by a victim in April 2023, with the total ransom amounting to $1.45 million.

Victims of BlackSuit and Royal are typically required to pay ransoms in Bitcoin via dark web sites. Cybersecurity officials warn that operators of such malware often combine intimidation tactics with sophisticated data theft techniques, making it extremely difficult to recover data without paying the ransom.