Ukraine's cyber police helps dismantle BlackSuit ransomware network

The BlackSuit group, a financially motivated cybercrime syndicate specializing in ransomware, demanded over $500 million in ransoms, with the largest single demand reaching $60 million.

The criminals developed malicious software that encrypted user data using algorithmic combinations, then demanded cryptocurrency ransoms for decryption and to prevent the release of stolen information.

The group primarily targeted commercial and public organizations outside CIS countries, including in the United States, Europe, and Japan.

Operation Checkmate was conducted in collaboration with the U.S. Department of Homeland Security, the Netherlands National Police, Germany’s Federal Criminal Police Office, the U.K.’s National Crime Agency, Frankfurt’s Public Prosecutor General’s Office, the U.S. Department of Justice, Europol, and other countries’ law enforcement agencies, as well as Romanian cybersecurity firm Bitdefender.

During the operation, authorities coordinated to dismantle BlackSuit’s cybercrime network, including seizing its websites in one of the domain zones.

Ukrainian cyber police traced the group’s history, noting it operated under multiple names: Quantum from January 2022, Royal from 2022 to 2023, BlackSuit from 2023, and Chaos starting in 2025.

In Ukraine, a criminal investigation has been launched under Article 361, Part 5, of the Criminal Code of Ukraine (unauthorized interference with information, automated, electronic communication, or information-communication systems and networks), which carries a penalty of up to 15 years in prison.

Previously, a hacker group in Ukraine was exposed for stealing funds from large industrial enterprises by infecting accountants’ computers with malicious software.