[ad_1]
The Department of Justice is expected on Monday to announce details of the operation led by the FBI in cooperation with the operator of the colony pipeline, people briefed on the matter said.
Ransomware recovery is a rare outcome for a company that has fallen victim to a cyber attack exhausted in the burgeoning ransomware criminal business.
Joseph Blount, CEO of Colonial Pipeline, told the Wall Street Journal in an interview published last month that the company complied with a $4.4 million ransom demand because officials didn’t know the extent of the hackers’ intrusion and how long it would take to restore operations. .
But behind the scenes, the company took early steps to notify the FBI and followed instructions that helped investigators trace payments to a cryptocurrency wallet used by the hackers, who are believed to be based in Russia. US officials have linked the colonial attack to a criminal hacking group known as Darkside that is said to be sharing its malware tools with other criminal hackers.
A Department of Justice spokesperson declined to comment, and CNN reached out to operator Colonial Pipeline.
CNN previously reported that US officials were searching for any potential operational or personal security holes for hackers in an effort to identify responsible actors — specifically monitoring any clues that might emerge from the way they moved their money, sources familiar with the effort said.
The Biden administration has focused on a less regulated structure of cryptocurrency payments that allows for greater anonymity as it ramps up efforts to disrupt increasingly destructive ransomware attacks, after two major incidents on critical infrastructure.
‘Abuse of Cryptocurrencies is a Big Enabler’
“The misuse of cryptocurrency is a huge enabler here,” Deputy National Security Adviser Anne Neuberger told CNN. “This is how people get money from it. With the increase in anonymity and the strengthening of cryptocurrencies, there is the emergence of mixing services that mainly work for money laundering.”
“Individual companies feel pressure – especially if they haven’t done cybersecurity work – to pay the ransom and move on,” Neuberger added. “But in the long run, that’s what drives the ongoing ransom [attacks]. And the more people get paid, the bigger and bigger the ransom and the more potential disruptions will be.”
While the Biden administration has made clear it needs help from private companies to stem the latest wave of ransomware attacks, federal agencies are adept at tracking the currency used to pay ransomware groups, CNN previously reported.
Two sources said last week that the government’s ability to do so effectively in response to the ransomware attack “depends on the situation.”
One source noted that helping to recover money paid to ransomware representatives is certainly an area in which the US government can help, but noted that success varies widely and depends largely on whether there are vulnerabilities in the attackers’ system that can be identified and exploited.
One source explained that in some cases, US officials can find ransomware operators and “own” their network within hours of the attack, noting that this allows relevant agencies to monitor the actor’s communications and possibly identify additional key players in the responsible group.
The sources added that when ransomware actors are more careful about their operational security, including how to move money, disable their networks or track currency, the matter becomes more complicated.
“It’s really a mixed bag,” they told CNN, noting the varying degrees of sophistication shown by the groups involved in these attacks.
One source also cautioned against putting too much stock in the US government’s actions, telling CNN that the unique circumstances around each attack and the level of detail needed to take effective action against these groups is part of why there is “no magic bullet” when it comes to countering ransomware attacks.
“It will take improved defenses, dismantling the profitability of ransomware and directing actions against attackers to stop this,” the source added, explaining that disrupting and tracking cryptocurrency payments is only one part of the equation.
This sentiment was echoed by cybersecurity experts who agreed that ransomware actors use cryptocurrency to launder their transactions.
According to Alex Stamos, former Facebook chief security officer and co-founder of Krebs Stamos Group: “In the age of Bitcoin, money laundering is something that any geek can do. You no longer need a major organized crime machine.”
He added: “The only way we will be able to respond to it as an entire community is to make it illegal…I think we should criminalize the payments.” “This is going to be really hard. The first companies to get hit once the payment is illegal, they’re going to be in a very difficult situation. We’re going to see a lot of pain and suffering.”
This story is down and will be updated.
.
[ad_2]
Picture Credit!