Uncle Sam recovers 63.7 of 75 Bitcoins Colonial Pipeline paid to ransomware crew
(2021/06/08)
- Reference: 1623122767
- News link: https://www.theregister.co.uk/2021/06/08/antiransomware_task_force/
- Source link:
The US Department of Justice on Monday said it has recovered 63.7 Bitcoins, right now worth $2.1m and falling, of the 75 or so BTC the Colonial Pipeline operators paid the ransomware miscreants who infected the fuel provider's computers.
Deputy Attorney General Lisa Monaco said Colonial contacted the Feds shortly after some of its internal IT systems were [1]infected by the extortionware, causing a temporary halt in operations. The days-long shutdown of the pipeline, which supplies a good chunk of the US East Coast, led to panic buying and some gas pumps running dry.
A ransom of about $5m or 75 BTC [2]was paid to the Darkside crew behind the attack.
[3]
It turns out the Feds were able to trace this payment through multiple transactions to "a specific address, for which the FBI has the 'private key',” the [4]DoJ said . "This Bitcoin represents proceeds traceable to a computer intrusion and property involved in money laundering, and may be seized pursuant to criminal and civil forfeiture statutes."
[5]
How the FBI had this private key is not clear: it could be that the Feds were able to gain access to a system hosting the key. It could be that someone gave them the key, or that the bureau got the key from them. This [6]court filing [PDF] goes into more detail on how agents traced the ransom payment.
"It's not the first time that the government has ever seized cryptocurrency in connection with ransomware attacks," said Monaco. "This is the first such seizure that the ransomware and digital taskforce has undertaken."
[7]
The Deputy AG continued that the Bitcoin seizure – authorized by a magistrate judge in California – was only possible because the Colonial Pipeline's operators got the FBI involved early in the process. She urged other victims of ransomware to come forward: there was no guarantee funds could be found and returned, she said, though cooperation was vital to slow the spread of the malware.
[8]JBS Foods ransomware gang: White House 'engaging directly' with Russia about attack on massive meat producer
[9]The policy of truth: As ransomware claims rise, what's a cyber insurer to do?
[10]We're right behind Computer Misuse Act reforms for busting ransomware gangs, says UK infosec industry
[11]American insurance giant CNA reportedly pays $40m to ransomware crooks
“For financially motivated cybercriminals, especially those presumably located overseas, cutting off access to revenue is one of the most impactful consequences we can impose,” said FBI Deputy Director Paul Abbate at a press conference on Monday. "We can have an immediate and permanent effect on ransomware." ®
Get our [12]Tech Resources
[1] https://www.theregister.com/2021/05/10/colonial_pipeline_ransomware/
[2] https://www.theregister.com/2021/05/13/colonial_pipeline_ransom/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YL7rXfc20Agw9Ve16UQhZQAAAJY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YL7rXfc20Agw9Ve16UQhZQAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://storage.courtlistener.com/recap/gov.uscourts.cand.379840/gov.uscourts.cand.379840.1.0.pdf
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YL7rXfc20Agw9Ve16UQhZQAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/06/02/jbs_fodds_ransomware/
[9] https://www.theregister.com/2021/06/04/ransomware_claims_feature/
[10] https://www.theregister.com/2021/06/07/cma_reforms_anti_ransomware_high_agenda/
[11] https://www.theregister.com/2021/05/22/in_brief_security/
[12] https://whitepapers.theregister.com/
Deputy Attorney General Lisa Monaco said Colonial contacted the Feds shortly after some of its internal IT systems were [1]infected by the extortionware, causing a temporary halt in operations. The days-long shutdown of the pipeline, which supplies a good chunk of the US East Coast, led to panic buying and some gas pumps running dry.
A ransom of about $5m or 75 BTC [2]was paid to the Darkside crew behind the attack.
[3]
It turns out the Feds were able to trace this payment through multiple transactions to "a specific address, for which the FBI has the 'private key',” the [4]DoJ said . "This Bitcoin represents proceeds traceable to a computer intrusion and property involved in money laundering, and may be seized pursuant to criminal and civil forfeiture statutes."
[5]
How the FBI had this private key is not clear: it could be that the Feds were able to gain access to a system hosting the key. It could be that someone gave them the key, or that the bureau got the key from them. This [6]court filing [PDF] goes into more detail on how agents traced the ransom payment.
"It's not the first time that the government has ever seized cryptocurrency in connection with ransomware attacks," said Monaco. "This is the first such seizure that the ransomware and digital taskforce has undertaken."
[7]
The Deputy AG continued that the Bitcoin seizure – authorized by a magistrate judge in California – was only possible because the Colonial Pipeline's operators got the FBI involved early in the process. She urged other victims of ransomware to come forward: there was no guarantee funds could be found and returned, she said, though cooperation was vital to slow the spread of the malware.
[8]JBS Foods ransomware gang: White House 'engaging directly' with Russia about attack on massive meat producer
[9]The policy of truth: As ransomware claims rise, what's a cyber insurer to do?
[10]We're right behind Computer Misuse Act reforms for busting ransomware gangs, says UK infosec industry
[11]American insurance giant CNA reportedly pays $40m to ransomware crooks
“For financially motivated cybercriminals, especially those presumably located overseas, cutting off access to revenue is one of the most impactful consequences we can impose,” said FBI Deputy Director Paul Abbate at a press conference on Monday. "We can have an immediate and permanent effect on ransomware." ®
Get our [12]Tech Resources
[1] https://www.theregister.com/2021/05/10/colonial_pipeline_ransomware/
[2] https://www.theregister.com/2021/05/13/colonial_pipeline_ransom/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YL7rXfc20Agw9Ve16UQhZQAAAJY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YL7rXfc20Agw9Ve16UQhZQAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://storage.courtlistener.com/recap/gov.uscourts.cand.379840/gov.uscourts.cand.379840.1.0.pdf
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YL7rXfc20Agw9Ve16UQhZQAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/06/02/jbs_fodds_ransomware/
[9] https://www.theregister.com/2021/06/04/ransomware_claims_feature/
[10] https://www.theregister.com/2021/06/07/cma_reforms_anti_ransomware_high_agenda/
[11] https://www.theregister.com/2021/05/22/in_brief_security/
[12] https://whitepapers.theregister.com/
Blockchain
Anonymous Coward
Or Blockheadchain?
OK, I'll go first
Winkypop
All your Bitcoin are belong to us
Sure i'll download a PDF from US gov website...
. not.