Gardaí help take down global ransomware gang

Garda cybercrime experts have played a key role in a massive international operation that has taken down the notorious Blacksuit Ransomware Group, responsible for crippling cyberattacks around the world.

The Garda National Cyber Crime Bureau (GNCCB) worked alongside the United States Immigration and Customs Enforcement (ICE) Homeland Security Investigations to dismantle the gang’s online infrastructure, including its dark web leaks page, victim negotiation site, and multiple domains linked to its criminal network.

The global sting saw unprecedented cooperation between agencies, with the US Department of Homeland Security, FBI, Secret Service, Dutch National Police, German State Criminal Police Office, UK National Crime Agency, Frankfurt General Prosecutor’s Office, Ukrainian Cyber Police, Europol, and private sector partners all involved.

The Blacksuit ransomware group — an organised cybercrime network — emerged in May 2023 as a rebrand of the Royal Ransomware Group, itself a spin-off from the notorious Conti Ransomware Group. Together, these gangs have been linked to some of the most damaging ransomware attacks in recent years, targeting businesses, public bodies, and critical infrastructure worldwide.

Assistant Commissioner for Organised and Serious Crime said the takedown was a significant blow to international cybercriminals.

“An Garda Síochána will continue to work with our international law enforcement colleagues and private partners to identify, target and disrupt organised crime groups using the infrastructure to carry out ransomware and other forms of cybercrime.

“Our work to date, involving close collaboration with international partners, will continue as part of our ongoing effort to keep people safe both online and offline.”

The operation is part of an ongoing campaign to hunt down and dismantle ransomware gangs that exploit victims for huge payouts.

Authorities say investigations are continuing and further arrests may follow.