InfoSecBulletin Cybersecurity for mankind
The FBI and CISA updated their advisory to confirm that the Royal ransomware group now goes by the name “BlackSuit” and still demands very high ransom amounts, up to $60 million.
The advisory has new technical information to help defenders detect the activity of the group, known as Royal ransomware from September 2022 to July 2023 and now called BlackSuit.
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
The group got attention from the police last summer when they attacked Dallas, causing damage to the city’s emergency services, courts, and government. In November, the FBI and CISA warned that Royal was transitioning to the “BlackSuit” branding for attacks. The latest update confirms that all of the group’s new attacks, some as recent as July, are linked to the new name.
“Ransom demands have typically ranged from approximately $1 million to $10 million, with payment demanded in Bitcoin,” the agencies said. “BlackSuit actors have exhibited a willingness to negotiate payment amounts.”
The agencies linked the hackers behind the two groups based on “numerous coding similarities” but noted that BlackSuit has “exhibited improved capabilities.”
Hackers still rely on phishing emails to launch successful attacks. They use these emails to gain initial access, disable antivirus software, steal a lot of data, and deploy ransomware.
The agencies noted there has been a recent uptick in attacks where victims “received telephonic or email communications from BlackSuit actors regarding the compromise and ransom.”
A new report from Sophos, a cybersecurity company, revealed that several ransomware groups are using this tactic to pressure victims into paying ransoms. Ransomware gangs have been contacting patients and customers of multiple hospitals and businesses, threatening them with data stolen or accessed during attacks.
According to Chester Wisniewski, Sophos Field CTO, ransomware gangs used to rely on media coverage to scare victims. However, in recent times, these groups have started directly contacting customers and patients as a new way to apply pressure.
Wisniewski argued that the tactic has not been successful, as companies mostly base their decision to pay ransoms on practical factors such as business downtime and regulatory concerns.
