BlackSuit infrastructure takedown

The BlackSuit onion address was archived with an Operation Checkmate seizure notice dated 24 July 2025. The U.S. Department of Justice later confirmed that coordinated actions on that date took down four servers and nine domains.

Current assessment: ONLINE → SEIZED. Supporting sources appear below.

BEFORE

No independently replayable pre-seizure capture of this exact onion address was found in the public web archives reviewed.

AFTER

Select an available image to open the preserved archive copy.

1. 24 Jul 2025 ONLINE → SEIZED

   Coordinated actions took down BlackSuit servers and domains, and a seizure notice was archived for this address.

Domain

weg7sdx54bevnvulapqu6bpzwztryeflq3s23tegbmnhkbpqz637f2yd.onion

Category

ransomware

Current status

SEIZED

Previous status

ONLINE

First seen

Not confirmed

Last seen

Not confirmed

Changed at

24 July 2025

Action type

coordinated infrastructure takedown

Agency

Homeland Security Investigations, U.S. Secret Service, IRS Criminal Investigation, Federal Bureau of Investigation

Registrar

Not confirmed

Hosting provider

Not confirmed

Country

United States, United Kingdom, Germany, Ireland, France, Canada, Ukraine, Lithuania

Related operation

Operation Checkmate

The BlackSuit onion address was archived with an Operation Checkmate seizure notice dated 24 July 2025. The U.S. Department of Justice later confirmed that coordinated actions on that date took down four servers and nine domains.

No replacement domain or mirror has been confirmed.

Visual similarity alone is not treated as evidence of common ownership. Websites can copy each other. This remains one of the internet’s more dependable features.

Extortion Wiki documents the actor, negotiations, ransom notes, victims, and related ransomware activity.

Open the full Extortion Wiki record →

vx-underground provides malware-family samples and technical research. These links provide family context and do not serve as evidence for the takedown documented above.

• BlackSuit malware-family archive → Family: BlackSuit · Publisher: vx-underground

  Family-level malware research reference; not evidence of the website seizure.

OpenSpy stores metadata and research links only. It does not mirror executable malware or sample archives.

1. Justice Department Announces Coordinated Disruption Actions Against BlackSuit (Royal) Ransomware Operations

   U.S. Department of Justice

   Type: official law-enforcement announcement · Published: 11 August 2025 · Accessed: 26 July 2026

2. BlackSuit / Operation Checkmate seizure banner

   Extortion Wiki

   Type: verified archive record · Published: 24 July 2025 · Accessed: 26 July 2026

Before snapshot

Not preserved

After snapshot

Available

Official confirmation

Not confirmed

Exact takedown time

Not confirmed

Last reviewed

26 July 2026

Send the record URL, the incorrect claim, and a source supporting the correction. “My friend said so” remains unsupported even when your friend types confidently.

Submit a correction →