FBI: BlackSuit ransomware made over $500 million in ransom demands

**Executive summary:** CISA and the FBI confirmed that the Royal ransomware operation rebranded to BlackSuit (originating as Quantum) and has been active since 2022; the agencies link the group to attacks on over 350 organizations, ransom demands totaling over $500 million (largest single demand $60M), use of both third‑party and custom encryptors (Zeon/BlackSuit), and major incidents including a CDK Global outage that impacted ~15,000 dealerships—CISA/FBI have published IOCs and TTPs to help defenders.