The US justice department has recovered the majority of a multimillion-dollar ransom payment to hackers after a cyber-attack that caused the operator of the nation’s largest fuel pipeline to halt its operations last month, officials said on Monday.
The operation to recover the cryptocurrency from the Russia-based hacker group is the first undertaken by a specialized ransomware taskforce created by the Biden administration, and reflects what US officials say is an increasingly aggressive approach to deal with a ransomware threat that in the last month has targeted critical industries around the world.
“By going after an entire ecosystem that fuels ransomware and digital currency, we will continue to use all of our tools and all of our resources to increase the costs and the consequences of ransomware attacks and other cyber-enabled attacks,” deputy attorney general Lisa Monaco said on Monday at a news conference announcing the operation.
Georgia-based Colonial Pipeline, which supplies roughly half the fuel consumed on the US east coast, temporarily shut down its operations on 7 May after a gang of criminal hackers known as DarkSide broke into its computer system.
Colonial officials have said they took their pipeline system offline before the attack could spread to its operating system, and decided to pay a roughly $4.4m ransom in hopes of bringing computers back online as soon as it could.
The 63.7 bitcoin ransom – a favored currency of hackers because of the perception that it is more difficult to trace – is currently valued at $2.3m.
“The extortionists will never see this money,” said Stephanie Hinds, the acting US attorney for the northern district of California, where the seizure warrant was filed.
The FBI generally discourages the payment of ransom, fearing it could encourage additional hacks, a stance reiterated by the White House press secretary, Jen Psaki, last Friday during the daily media briefing.
On that day, the FBI director, Christopher Wray, warned that tackling cyber hacks and ransomware attacks on US government and commercial entities would be akin to battling the international terrorist threat to the US following the hijacking attacks masterminded by al-Qaida on 9/11.
Joe Biden plans to bring the issue up with the Russian president, Vladimir Putin, in the two leaders’ scheduled meeting in Switzerland later this month, with the Biden administration emphasizing that even if the Russian government is not behind these attacks, countries harboring cybercrime gangs must be responsible for dealing with them.
Monaco said the takeaway for the private sector is that if companies come quickly to law enforcement, officials may be able to conduct similar seizures in the future.
Soon after the cyber-attack on Colonial Pipeline, another attack took meat-processing factories across the US offline.
Attacks generally consist of a group of cybercriminals hacking into a company, or, for example, a local or state government’s, network, and scramble the data. The hacker then demands payment in exchange for handing back control of the system.
In the Colonial Pipeline case, Darkside took responsibility for the attack.
“DarkSide is a ransomware-as-a-service network – that means developers who sell or lease ransomware to use in attacks, in return for a fee or share in the proceeds,” said Monaco.
“DarkSide and its affiliates have digitally stalked US companies for the better part of the year, and indiscriminately attacked victims that include key players in our nation’s critical infrastructure. Today, we turned the tables on DarkSide.
Asked at the press conference on Monday if the latest developments mean other companies should also pay ransoms, Monaco said no.
“We cannot guarantee – and we may not be able to do this in every instance.”
