Skip to content
DysruptionHub
Sign in Subscribe

blacksuit

Ransomware Group2 claimsLast activity:

Overview

BlackSuit is a financially motivated ransomware and data-extortion operation. The FBI and CISA identified it in August 2024 as an evolution of Royal ransomware, with shared code and expanded capabilities. Their advisory describes stealing data, encrypting systems and using a leak site to pressure victims, with phishing, compromised remote access and vulnerable applications among observed entry methods. HHS documented BlackSuit’s Windows and Linux variants and substantial similarities to Royal in November 2023, when the relationship remained uncertain. In August 2025, the Justice Department announced that authorities had seized four servers and nine domains on July 24, 2025, and approximately $1 million in virtual currency connected to the operation. Those actions disrupted infrastructure; they do not establish that every operator ceased activity. General group techniques and victim-list allegations do not independently establish responsibility, encryption or a particular attack method in any individual incident.

Incident claims

Marysville schools ransomware disrupts classes and systems

Incident date: Source: ransomware.liveDiscovered:

Claim details

Ransomware.live indexes a BlackSuit victim claim for marysville.k12.oh.us, discovered Nov. 15, 2024, at 19:01:24.117850 UTC. This is tracker observation time, not a verified original actor-post date or attack date. Original Comparitech reporting on Nov. 15 attributes a claim of 121GB of stolen data to BlackSuit. The district separately confirmed unauthorized network access Oct. 5–26 and information copying, and a district FAQ quoted by Comparitech described ransomware. These establish a cyber incident and ransomware evidence but do not independently confirm BlackSuit responsibility or the claimed volume. The reviewed original official notice names no attacker, gives no affected-person count and establishes no ransom demand/payment or confirmed data publication. Reuse this existing claim and shared BlackSuit actor; attribution remains low confidence.

Rutherford County Schools breach disrupts network access

Incident date: Source: ransomware.liveDiscovered:

Claim details

A BlackSuit listing for rcschools.net was observed by ransomware.live Oct. 19, 2024, before the school disruption beginning Nov. 25. The tracker gives no attack date. This earlier allegation is retained for investigation; reviewed evidence does not establish that it concerns the same intrusion or identifies the operator responsible for the November disruption. The original Ghost article’s BlackSuit suggestion is not independent attribution evidence.

Impacted organizations

Impacted locations

Sources

Created Last updated