Royal Ransomware Tracker: BlackSuit, Chaos and the 2025 Crackdown

TL;DR: Royal ransomware was the original name. BlackSuit is the name the same crew was running under by August 2024, and Chaos is the name researchers say those people turned up under in 2025. The joint advisory that CISA and the FBI publish on BlackSuit says the group hit critical manufacturing, government facilities, healthcare and public health, and commercial facilities, and it names no victim organization and no victim count.^[1]^[2] On July 24, 2025 a multinational police operation took down four BlackSuit servers and nine domains, and on August 11, 2025 the Justice Department unsealed a warrant for the seizure of $1,091,453 in virtual currency.^[2] The money behind that seizure is on the record too: on or about April 4, 2023 a victim paid a ransom of 49.3120227 Bitcoin, worth $1,445,454.86 at the time, and a portion of those proceeds was frozen by a virtual currency exchange on or about Jan. 9, 2024.^[2] And in a report published May 6, 2026, Rapid7 says the Chaos ransomware-as-a-service operation has been active since February 2025, is likely composed of former BlackSuit and Royal members, and had claimed 36 victims by late March 2026.^[5]

The Three Names, In Order

The name matters here, because if you are trying to work out whether your data was taken, the entry sitting under a different name than the one you searched for is the entire problem.

It starts with Royal. The advisory that now carries the BlackSuit name puts the timeline in one sentence: "BlackSuit ransomware is the evolution of the ransomware previously identified as Royal ransomware, which was used from approximately September 2022 through June 2023."^[1] That is the whole of the Royal timeline, and then the name changed.

Then came the exit. On August 7, 2024, CISA published an update with the title "Royal Ransomware Actors Rebrand as “BlackSuit,” FBI and CISA Release Update to Advisory", which said "FBI investigations identified these TTPs and IOCs as recently as July 2024."^[3] The advisory itself was revised on the same day, adding the rename along with new tactics, indicators and detections. BlackSuit is the name that the advisory and the law-enforcement action of July 2025 both use.

MITRE tracks the malware itself, and its entry is the technical one. It lists the malware as Royal, software S1073, version 1.2, created March 30, 2023 and last modified October 21, 2025.^[4] Its notes on behavior are the ones defenders work from. MITRE records that "Royal can delete shadow copy backups with vssadmin.exe using the command delete shadows /all /quiet", that "Royal can use SMB to connect to move laterally", and that "Royal can use RmShutDown to kill applications and services using the resources that are targeted for encryption."^[4]

Then there is the third name, and that is where the story gets more interesting than a tracker usually does. More on it below.

How They Get In

Phishing is the front door, and the advisory is not coy about it: "BlackSuit actors most commonly gain initial access to victim networks via phishing."^[1] The lures it describes are malicious PDF attachments and malvertising links, delivered through email and through public-facing sites.

The second door is a remote desktop. "The second most common vector (around 13.3% of incidents) BlackSuit actors use for initial access is RDP compromise."^[1] The advisory's list of initial-access methods also includes exploitation of vulnerable public-facing applications.^[1]

Then there are the entrances nobody in your organization chose to open. The advisory reports that BlackSuit actors use initial access brokers, who get access and traffic by harvesting virtual private network (VPN) credentials from stealer logs.^[1] An initial access broker is a criminal who already owns stolen credentials and sells the resulting entry to a ransomware crew. The VPN account that failed its password policy last year is somebody else's business now.

And the crew abused software most companies bought on purpose. The advisory says the "FBI observed BlackSuit actors using legitimate remote monitoring and management (RMM) software to maintain persistence in victim networks."^[1] Remote monitoring tools are the same ones your IT team uses to patch machines at 2am. If the software is installed and authorized, there is nothing to alert on.

MITRE's write-up of the malware adds a detail worth putting in your phishing training: Royal has been spread through phishing campaigns including "call back phishing" where victims are lured into calling a number provided through email.^[4] Nobody clicks a link, because there is no link.

What They Take, and How

The playbook is double extortion with one unusual twist attached to the encryptor. The advisory says the crew conducts data exfiltration and extortion before it encrypts anything, and that after getting in the actors disable antivirus, collect large quantities of data, exfiltrate it, and then encrypt systems.^[1] The order is the point. By the time your files are scrambled, the theft is already finished and the countdown is already running.

The exfiltration tooling is not exotic. The advisory says BlackSuit actors "exfiltrate data from victim networks by repurposing legitimate cyber penetration testing tools, such as Cobalt Strike, and malware tools/derivatives, such as Ursnif/Gozi, for data aggregation and exfiltration", and that "BlackSuit actors also use RClone and Brute Ratel for exfiltration."^[1] A penetration testing tool being used to move stolen data out of your network is not going to look like a penetration testing tool in your logs.

The advisory also puts the first hop in a useful place: "According to third-party reporting, BlackSuit actors’ first hop in exfiltration and other operations is usually a U.S. IP address."^[1] It lists the associated infrastructure as the domain mystuff[.]bublup[.]com.^[1] A US source address is not evidence of innocence, and it is not a filter that works either way.

The encryption has its own signature. "BlackSuit uses a unique partial encryption approach that allows the threat actor to choose a specific percentage of data in a file to encrypt."^[1] The reason given is to lower the encryption percentage for larger files, which helps with evasion and speed. MITRE describes the same behavior from the malware side: "Royal uses a multi-threaded encryption process that can partially encrypt targeted files with the OpenSSL library".^[4] If you find some files partially encrypted rather than fully encrypted, that is the signature.

Before the encryptor runs, the crew tidies up. The advisory's mitigation section names the step directly: "Use Windows Volume Shadow Copy service (vssadmin.exe) to delete shadow copies to inhibit system recovery."^[1] On virtualised infrastructure the same crew works one level lower. MITRE notes that "Royal ransomware uses esxcli to gather a list of running VMs and terminate them."^[4] That is a hypervisor command. It kills the virtual machine rather than the operating system running inside it.

What they claim to have taken is in the note. The advisory lists the ransom note file as readme.BlackSuit.txt, with SHA-256 hash 1743494f803bbcbd11150a4a8b7a2c5faba1223da607f67d24b18ca2d95d5ba3.^[1] The note claims the crew holds "financial reports, intellectual property, accounting, law actions and complaints, personal files".^[1] And the note is not where the negotiation happens: "Ransom amounts are not part of the initial ransom note, but require direct interaction with the threat actor via a .onion URL."^[1] You can check your own disks against that hash before you panic.

What It Costs, and What the Record Does Not Say

The advisory puts a range on it: "Ransom demands have typically ranged from approximately $1 million to $10 million USD, with payment demanded in Bitcoin."^[1] And the running total: "BlackSuit actors have demanded over $500 million USD in total and the largest individual ransom demand was $60 million."^[1]

Those two sentences are the closest thing to a victim count in the advisory, and they deserve to be read in proportion. The advisory names no victim organization and gives no number of victims.^[1] If you are looking for a federal roster that tells you whether your employer or your hospital was hit, there is not one. The money is documented. The victim list is not.

July 2025: What the Police Took

On August 11, 2025, the Justice Department announced coordinated actions against the BlackSuit (Royal) ransomware group, including "the takedown of four servers and nine domains on July 24, 2025."^[2] The takedown was run by the Department of Homeland Security's Homeland Security Investigations, the US Secret Service, IRS Criminal Investigation and the FBI, with law enforcement partners in the United Kingdom, Germany, Ireland, France, Canada, Ukraine and Lithuania.^[2]

The money was the second half of the operation. The release says the actions included "the unsealing of a warrant for the seizure of virtual currency valued at $1,091,453 at the time of the seizure", announced jointly by the US Attorney's Offices for the Eastern District of Virginia and the District of Columbia.^[2] The provenance is unusually specific: "On or about April 4, 2023, a victim paid a ransom of 49.3120227 Bitcoin to decrypt their data. This ransom was worth $1,445,454.86 at the time of the transaction."^[2] A portion of those proceeds, $1,091,453, was repeatedly deposited and withdrawn into a virtual currency exchange account until the funds were frozen by that exchange on or about Jan. 9, 2024.^[2] Evidence in the case was collected on or about June 21, 2024.^[2]

What did not happen is worth stating too. The release announces no arrests, no charges and no decryptor.^[2] The operation took infrastructure and money. It did not take the people.

Assistant Attorney General for National Security John A. Eisberg put the stakes plainly: "The BlackSuit ransomware gang’s persistent targeting of U.S. critical infrastructure represents a serious threat to U.S. public safety."^[2] U.S. Attorney Erik S. Siebert for the Eastern District of Virginia framed it as a method rather than a moment: "This action exemplifies the forward-leaning, disruption-first approach we are taking to address this threat."^[2] And Deputy Assistant Director Michael Prado for HSI's Cyber Crimes Center made the point about the infrastructure itself: "Disrupting ransomware infrastructure is not only about taking down servers, it’s about dismantling the entire ecosystem that enables cybercriminals to operate with impunity."^[2]

Chaos: The Third Name

The servers went dark. The people did not.

In a report published May 6, 2026, Rapid7's Alexandra Blia and Ivan Feigl describe Chaos as a ransomware-as-a-service operation that has been active since February 2025, specializing in what they call big-game hunting, with reported ransom demands reaching up to $300,000.^[5] The link back to the crew that was just dismantled is their central claim: the group "emerged shortly after the July 2025 law enforcement disruption of BlackSuit infrastructure during Operation Checkmate and is likely composed of former BlackSuit and/or Royal members."^[5]

The scale they could put on it: "As of late March 2026, Chaos has claimed 36 victims and maintained a consistent operational tempo."^[5] The targets are not hospitals. The group "predominantly targets organizations in the United States, with a particular focus on the construction, manufacturing, and business services sectors."^[5]

The pressure tactics escalated. Rapid7 says Chaos "typically employs double extortion, exfiltrating sensitive data prior to encryption and threatening public disclosure via its data leak site", that the group "has also demonstrated triple extortion by threatening distributed denial-of-service (DDoS) attacks against the victim’s infrastructure", and that Chaos has been observed using elements of quadruple extortion, including threats to contact customers or competitors to increase pressure on victims.^[5] One detail changes how you read a countdown timer: the leak site uses a “blind” countdown timer, which withholds the victim’s identity until expiration, likely intended to accelerate negotiations.^[5]

The way in is different too, and it starts in a video call. Rapid7's intrusion analysis describes attackers using Microsoft Teams external chats with interactive screen-sharing to harvest credentials and manipulate multi-factor authentication, then a Quick Assist themed phishing page at adm-pulse[.]com, then persistence through legitimate remote tools including DWAgent, and a downloader named ms_upd.exe that reported back to moonzonet[.]com.^[5]

And the conclusion is the strange one. Rapid7 attributes the campaign to MuddyWater, an Iranian group tied to the Ministry of Intelligence and Security, at moderate confidence, and says that in the incident they investigated the operator ran under the Chaos banner but skipped encryption in favor of exfiltration, which forensic analysis showed was a “false flag” masquerade.^[5] The malware carried a code-signing certificate issued to a name Rapid7 lists as Donald Gay, and Rapid7 describes that certificate as “a known shared resource within MuddyWater’s toolkit.”^[5] The point for a reader is not the geopolitics. It is that a ransom payment is not proof that your files are encrypted, and a crew's name on a leak site is not proof of who did the work.

What you can look for on disk, according to ExtraHop's research, is concrete. The encryptor drops a ransom note named README.chaos.txt in every affected directory, and on Linux or ESXi systems, "the filename typically uses lowercase: readme.chaos.txt."^[6] "Encrypted files are appended with the .chaos extension."^[6] The behavioral tells it lists include automated execution of the command vssadmin.exe delete shadows /all /quiet to prevent system recovery, unauthorized changes to Group Policy Objects to disable domain-wide antivirus or EDR agents, and unauthorized execution of esxcli with the -killvm parameter on ESXi management interfaces.^[6] For network teams it flags "Unusual interactive traffic over standard ports using tools like Chisel or SystemBC" and "Outbound spikes to unauthorized external IP addresses or storage services via rclone or FTP."^[6]

What the Feds Say to Do

The advisory's list of actions to take today is short, and all three of them are unglamorous. "Prioritize remediating known exploited vulnerabilities." "Train users to recognize and report phishing attempts." "Enable and enforce multifactor authentication."^[1]

The longer list is about the network rather than the workstation. Segment networks to constrain ransomware spread and lateral movement. "Require Phishing-Resistant multifactor authentication to administrator accounts" Review domain controllers, servers, workstations and Active Directory for new or unknown accounts. Disable unused ports. Disable macros by default. Apply time-bounded administrative access and Just-in-Time privileged access.^[1]

Backups get their own emphasis, because they are the part that decides whether this is an expensive Tuesday or the end of the company. The advisory calls for organizations to "Maintain offline backups of data, and regularly maintain backup and restoration" and to "Ensure all backup data is encrypted," immutable, and covering the entire organization's data infrastructure.^[1] Offline and immutable are doing real work in that sentence. A backup that sits on the same network, reachable by the same administrator credentials, is not a backup of anything a ransomware crew cannot reach.

If you are already in it, the reporting instructions are specific. The FBI wants "any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with BlackSuit actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file."^[1] You can report to the FBI's Internet Crime Complaint Center, a local FBI field office, or CISA.^[1]

And on the question everybody asks: "The FBI and CISA do not encourage paying ransom as payment does not guarantee victim files will be recovered."^[1] The advisory also notes that payment funds the next operation. That is not a moral argument. It is what the money is for.

What It Means For You

If your organization was hit, or if you are the person who gets to decide what happens next, work through the advisory's three immediate priorities in order. Patch the internet-facing systems with known exploited vulnerabilities first, because that is where the entry paths are. Then the phishing training, with call-back scams added to the curriculum, because MITRE's own record shows this crew uses the phone as well as the inbox.^[4] Then multifactor authentication, phishing-resistant for administrators, which is the control that actually breaks the credential-theft chain the advisory describes.^[1]

Before anyone touches a restore, check the backups. The advisory wants them offline, encrypted, immutable and covering the whole organization, and it wants restoration tested on a regular basis rather than assumed.^[1] ExtraHop's indicators give you a way to confirm what you are dealing with before you rebuild: README.chaos.txt in a directory, a .chaos extension on files, and the vssadmin shadow copy deletion in the logs.^[6] MITRE's entry gives you the older Royal equivalent, including the vssadmin command and the SMB lateral movement.^[4]

If you are checking your own exposure, the honest answer is that no federal list will settle it. The advisory names no victim organization and no victim count, and the Justice Department's release names none either.^[1]^[2] What will settle it is the letter from the organization that holds your data, and the breach notification that follows. If one arrives, the gang's name is almost never in it. The organization's name is, because the notification is about their liability, not about the crew's brand. Our guide to freezing your credit covers the first thing to do with an SSN that just went into a leak.

Finally, if this lands on your desk at work, the reporting path is the part people skip. IC3, your local FBI field office, or CISA, with the ransom note and the Bitcoin wallet details if you have them.^[1] That is exactly the material the FBI asked for, and it is the material that made the $1,091,453 seizure possible in the first place.^[2]

Sources

Published: November 1, 2026