LIVE: Gardai assist in global operation to dismantle Blacksuit ransomware infrastructure
Critical infrastructure used by cybercriminal operation seized as part of Operation Checkmate
Members of An Garda Siochana have helped successfully seize and dismantle key operational infrastructure being used by a global cybercriminal organisation.
A major disruption operation, involving various law enforcement agencies, has concluded resulting in the seizure and takedown of key operational infrastructure, including the dark web leaks page and the victim negotiation site, as well as domains attributed to the Blacksuit Ransomware Group.
Led by the United States Immigration and Customs Enforcement Homeland Security Investigations, Operation Checkpoint also involved the Garda National Cyber Crime Bureau, the United States Department of Homeland Security, U.S. Secret Service, US FBI, the Dutch National Police, the German State Criminal Police Office, the U.K. National Crime Agency, the Frankfurt General Prosecutor's Office, the Ukrainian Cyber Police and Europol, assisted by private partners.
The Blacksuit ransomware group are an organised crime group responsible for the commission of ransomware and other serious cyber criminality internationally.
The group emerged in May 2023, as a result of the rebranding of the Royal Ransomware Group; itself originating from the Conti Ransomware Group, responsible for a number of serious ransomware attacks internationally.
Commenting on the operation, Angela Willis, Assistant Commissioner for Organised and Serious Crime said: ‘An Garda Síochána will continue to work with our international law enforcement colleagues and private partners to identify, target and disrupt organised crime groups using the infrastructure to carry out ransomware and other forms of cybercrime. Our work to date involving close collaboration with international partners, including this seizure and takedown of key online operational infrastructure will continue as part of our ongoing effort to keep people safe both on an offline".
Michael Prado, Deputy Assistant Director of US HSI Cyber Crimes Center said: “Disrupting ransomware infrastructure is not only about taking down servers — it's about dismantling the entire ecosystem that enables cybercriminals to operate with impunity. This operation is the result of tireless international coordination and shows our collective resolve to hold ransomware actors accountable.”