U.S. Recovers $2.3 Million Ransom Paid to Colonial Pipeline Hackers

In a significant blow, the U.S. Department of Justice on Monday claimed it has recovered 63.7 bitcoins (currently valued at $2.3 million) paid by Colonial Pipeline to the DarkSide ransomware extortionists on May 8, pursuant to a seizure warrant that was authorized by the Northern District of California.

The ransomware attack also hobbled the pipeline firm’s gas supply, prompting the authorities to issue an emergency declaration, even as the firm shelled out a ransom amount of roughly 75 bitcoins ($4.4 million as of May perhaps 8) to regain entry to its systems.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

A week following the hugely publicized incident, the ransomware-as-a-support syndicate disbanded with a May well 14 farewell message to affiliates, stating that its internet servers and cryptocurrency stash had been seized by unknown legislation enforcement entities. When DarkSide’s announcement was perceived as an exit rip-off, the most up-to-date move from DoJ confirms earlier speculations of regulation enforcement involvement.

Stating that “ransom payments are the gas that propels the electronic extortion engine,” the DoJ said it followed the revenue trails still left by the DarkSide gang to a unique bitcoin address by reviewing the Bitcoin community ledger, to which the proceeds of the ransom payment were being transferred, in the long run applying the “personal critical” the FBI experienced in its possession to entry crypto property saved in the wallet in concern.

“There is no place past the arrive at of the FBI to conceal illicit funds that will stop us from imposing risk and outcomes on destructive cyber actors,” mentioned FBI Deputy Director Paul Abbate. “We will continue to use all of our readily available resources and leverage our domestic and international partnerships to disrupt ransomware attacks and guard our personal sector partners and the American public.”

It can be not promptly obvious how the intelligence agency came to have the non-public essential, but DarkSide had beforehand claimed to have dropped entry to a person of their payment servers.

Blockchain analytics firm Elliptic, which had determined the bitcoin transaction representing the Colonial Pipeline ransom payment, reported the seized bitcoins represent 85% of the complete ransom quantity which is typically reserved for affiliates, with the relaxation likely to the DarkSide developers. The Bitcoin handle was emptied at all around 1:40 p.m. ET on Monday, Dr. Tom Robinson, Elliptic’s co-founder and main scientist, stated.

If just about anything, the seizure marks a first-of-its-variety orchestrated exertion led by the DoJ’s newly shaped Ransomware and Digital Extortion Job Power to confiscate a cybercriminal cartel’s illicit profits by breaking into its bitcoin wallet.

“Holding cyber criminals accountable and disrupting the ecosystem that will allow them to operate is the very best way to prevent and defend against potential attacks of this nature,” Colonial Pipeline CEO Joseph Blount claimed in the statement. “The personal sector also has an similarly critical position to play and we must proceed to get cyber threats seriously and invest accordingly to harden our defenses.”

Located this report intriguing? Observe THN on Fb, Twitter  and LinkedIn to study more special content we submit.