BlackSuit

A ransomware and data-extortion operation derived from the Royal ransomware ecosystem and active from 2023. It targeted large organizations, stole data, and encrypted Windows and VMware ESXi systems before its infrastructure was seized in a coordinated international action in 2025.