The BlackSuit ransomware group, active since 2023 and believed to be a rebrand of Royal ransomware, has been dismantled in a global law enforcement operation known as Operation Checkmate. This group targeted various sectors, including education, government, healthcare, IT, manufacturing, and retail, demanding ransoms ranging from $1 million to $60 million. They leveraged stolen data for extortion, encrypting files across systems and using a Tor-based leak site to publish victim data if ransoms were not paid. The group’s Tor data leak site was seized by U.S. Homeland Security Investigations, with support from seventeen (17) law enforcement agencies. The seizure marks a significant blow to the group, which had listed approximately 200 victims by July 2025. BlackSuit’s tactics included phishing campaigns, exploiting vulnerabilities, and using tools like Cobalt Strike and Ursnif for data exfiltration. Cybersecurity researcher Cisco Talos had noted the emergence of Chaos ransomware, which shares similarities with BlackSuit, suggesting it may be a rebranding or operated by former members. Researchers suspect this due to their similar encryption techniques, ransom note structures, and use of living-off-the-land binaries, along with overlapping operational tactics like targeting large enterprises and employing specific configurations for file encryption. These shared characteristics suggest continuity in strategy and execution, typical of rebranding efforts in cybercrime.