# What are Royal and BlackSuit ransomware?

Royal was a ransomware operation active from about September 2022, and BlackSuit is its successor. CISA and the FBI first described Royal in advisory AA23-061A of 2 March 2023; an update in November 2023 counted over 350 known victims since September 2022, and an update in August 2024 states that BlackSuit is a rebrand of Royal and that the actors' ransom demands exceeded 500 million US dollars in total, the largest single demand being 60 million. Phishing was the most common way in, followed by remote desktop, the exploitation of public-facing applications and access bought from brokers. In July 2025, an international operation coordinated through Europol and led by US Homeland Security Investigations seized BlackSuit's servers and domains, as the US Justice Department announced in August 2025. No arrests were reported, and researchers observed members moving to new operations. The defences in the advisory remain relevant whatever the brand.

FAQ: [Ransomware groups and families](https://netsenx.com/en/faq/ransomware-families) · https://netsenx.com/en/faq/what-are-royal-and-blacksuit-ransomware

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [What is Rhysida ransomware?](https://netsenx.com/en/faq/what-is-rhysida-ransomware)
- [What is Medusa ransomware?](https://netsenx.com/en/faq/what-is-medusa-ransomware)
- [What is RansomHub ransomware?](https://netsenx.com/en/faq/what-is-ransomhub-ransomware)
- [What is Cl0p ransomware?](https://netsenx.com/en/faq/what-is-cl0p-ransomware)
- [What is BianLian ransomware?](https://netsenx.com/en/faq/what-is-bianlian-ransomware)