International investigators have dismantled the digital infrastructure of a major global cyber extortion network, believed to be behind hundreds of ransomware attacks worldwide.

Authorities identified and shut down servers used by the cybercrime group operating as Blacksuit/Royal, police in the German state of Lower Saxony said.

The takedown disrupted the group’s operations, including malware distribution, internal communications, and its website.

Officials reported a total of 184 victims globally, including several in Germany. Damages recorded as of August 2024 exceeded $500 million, according to police estimates.

The coordinated operation, a long-term effort, led to the securing of large volumes of data at the end of July.

Authorities hoped that the materials would help identify those responsible.

“This sends a clear signal in the fight against cybercrime,” LKA president Thorsten Massinger said in a statement.

He added that authorities would use every available tool to counter attacks on companies, public institutions, and private individuals.

Victims were urged to report incidents to prevent further attacks.

Investigators said the group used double extortion tactics.

Hackers not only encrypted victims’ data but first stole it, allowing them to threaten publication or sale even if files were recovered, pressuring victims into paying ransom.

(dpa/NAN)