BlackCat Ransomware Gang Recovers From Early December Law Enforcement Operation, Restores Websites Seized by DOJ

The Tor website that BlackCat uses to name-and-shame its ransomware victims became inaccessible on December 7, something that the group initially tried to claim was a technical problem. About a week and a half later, a standard DOJ website seizure notification appeared to visitors and the agency confirmed that a law enforcement operation had taken place.

“This takedown is a huge win for law enforcement and it highlights the force the FBI is using to target cybercriminals.”

Some security experts that follow the group believe that this may still be the beginning of the end for BlackCat. Law enforcement reportedly obtained access to the spaces affiliates use, something that is likely to spook many of them into switching to other ransomware-as-a-service (RaaS) providers. With enough of a drop in business, BlackCat might be prompted to scuttle the operation and regroup under a new brand name.

Our CTO, Ryan McConechy, notes that this is nevertheless another substantial victory for general cybersecurity as he speaks with CPO Magazine.