Ransom Ledger

BlackSuit

Also known as Royal (predecessor)

A rebrand of Royal, itself an offshoot of Conti. Linked by blockchain tracing to the CDK Global payment. Its leak and negotiation sites were seized in Operation Checkmate in July 2025.

What it is
Ransomware operation
Based
Russian-speaking
Active
2023–2025
Status
Disrupted

On the record

  1. Jul 2025 · Infosecurity Magazine

    Police seize BlackSuit's leak and negotiation sites in Operation Checkmate

  2. Jul 2024 · CyberScoop

    Blockchain tracing points to a $25 million payment to BlackSuit after the CDK attack

In the ledger

$25 million paid in the one payment listed

  • Jun 2024CDK Global paid $25 million. Reported.