[ad_1]
After Colonial Pipeline on May 8 paid nearly $4.4 million in cryptocurrency to hackers holding its computer systems hostage, the FBI pursued digital money.
Court records show that over the next 19 days, a private agent monitored a publicly visible bitcoin ledger as hackers transferred the 75 bitcoins to other digital addresses. Nearly 64 bitcoins were transferred on May 27 to a virtual address that the FBI had access to, providing an opportunity to get an injunction and swoop.
On Monday, the Department of Justice said it had recovered some cryptocurrency, the equivalent of $2.3 million from Colonial’s initial ransom.
Cybersecurity experts explain that the operation demonstrates the increasing technical ability of investigators to disrupt the financial infrastructure that has enabled ransomware gangs to squeeze hundreds of millions of dollars into victims each year. Despite the reputation of cryptocurrency as a medium of exchange that is difficult to trace and beneficial to criminals and other groups operating outside the traditional financial system, cryptocurrency experts say that it is sometimes easier to track than hard currencies such as the US dollar.
Subscribe to newsletters
WSJ Pro for Cyber Security
Cybersecurity news, analysis, and insights from WSJ’s global team of reporters and editors.
“You can’t hide behind cryptocurrency,” said Elvis Chan, assistant special agent in charge of the FBI’s cyber branch in San Francisco.
Senior Biden administration officials in recent weeks have described ransomware, in which criminals lock down an organization’s data or computer system and demand payment, as an urgent national security threat. On Wednesday, the CEO of the meat company said it had paid $11 million in ransom to cybercriminals after a hack that shut down factories that process nearly a fifth of the country’s meat supply.
While Monday’s announcement was noteworthy for the scale of the recovery and the broad impact of the initial attack on the pipeline company, in recent years law enforcement officials have built an impressive track record of tracking and occasionally seizing cryptocurrencies.
Money Trail hackers transfer ransom payments to evade law enforcement but the Department of Justice has been able to track and seize cryptocurrencies
1. Hackers hack and spread ransomware.
2. Ransomware locks up company data, which can paralyze computer systems and operations.
3. Victims receive a message asking them to pay for a tool to unlock their data. Hackers share a digital wallet address where victims can deposit cryptocurrency, most often bitcoin.
4. Victims often contact cybersecurity companies to negotiate with hackers and verify any association with sanctioned governments or individuals. Brokers can convert cash into cryptocurrencies, facilitating the conversion.
5. Hackers often transfer funds between wallets to hide their activity or pay the salaries of fellow hackers who participated in the hack. Some ransomware gangs hire money laundering services to help clean up cryptocurrency. Hackers transfer digital funds into hard currencies, such as the US dollar, on cryptocurrency exchanges abroad.
1. Hackers hack and spread ransomware.
2. Ransomware locks up company data, which can paralyze computer systems and operations.
3. Victims receive a message asking them to pay for a tool to unlock their data. Hackers share a digital wallet address where victims can deposit cryptocurrency, most often bitcoin.
4. Victims often contact cybersecurity companies to negotiate with hackers and verify any association with sanctioned governments or individuals. Brokers can convert cash into cryptocurrencies, facilitating the conversion.
5. Hackers often transfer funds between wallets to hide their activity or pay the salaries of fellow hackers who participated in the hack. Some ransomware gangs hire money laundering services to help clean up cryptocurrency. Hackers transfer digital funds into hard currencies, such as the US dollar, on cryptocurrency exchanges abroad.
1. Hackers hack and spread ransomware.
2. Ransomware locks up company data, which can paralyze computer systems and operations.
3. Victims receive a message asking them to pay for a tool to unlock their data. Hackers share a digital wallet address where victims can deposit cryptocurrency, most often bitcoin.
4. Victims often contact cybersecurity companies to negotiate with hackers and verify any association with sanctioned governments or individuals. Brokers can convert cash into cryptocurrencies, facilitating the conversion.
5. Hackers often transfer funds between wallets to hide their activity or pay the salaries of fellow hackers who participated in the hack. Some ransomware gangs hire money laundering services to help clean up cryptocurrency. Hackers transfer digital funds into hard currencies, such as the US dollar, on cryptocurrency exchanges abroad.
1. Hackers hack and spread ransomware.
2. Ransomware locks up company data, which can paralyze computer systems and operations.
3. Victims receive a message asking them to pay for a tool to unlock their data. Hackers share a digital wallet address where victims can deposit cryptocurrency, most often bitcoin.
4. Victims often contact cybersecurity companies to negotiate with hackers and verify any association with sanctioned governments or individuals. Brokers can convert cash into cryptocurrencies, facilitating the conversion.
5. Hackers often transfer funds between wallets to hide their activity or pay the salaries of fellow hackers who participated in the hack. Some ransomware gangs hire money laundering services to help clean up cryptocurrency. Hackers transfer digital funds into hard currencies, such as the US dollar, on cryptocurrency exchanges abroad.
Justice Department officials said in November that they seized nearly $1 billion in cryptocurrency linked to the online black market in Silk Road. In January, law enforcement officials said that the Department of Justice seized more than $454,000 in cryptocurrency from a ransomware group known as NetWalker.
Federal officials have previously dismantled illicit crypto networks operating abroad, including seizing accounts and funds linked to al-Qaeda and the Izz al-Din al-Qassam Brigades, the military wing of the Palestinian Islamic Resistance Movement (Hamas) in August. Court records show that an Internal Revenue Service agent tracked transactions intended to fund groups to Turkish money launderers who had additional customers in the United States or were using US-based exchanges.
The FBI has shared some details about how it seized a portion of the cryptocurrency that Colonial Pipeline paid to DarkSide, a ransomware gang that investigators believe operates in Russia. But court records, along with interviews with analysts, describe the extensive way investigators traced funds from the pipeline operator’s vaults to a court-ordered Bitcoin address they accessed.
Cryptocurrencies are held in digital accounts called wallets, which store virtual addresses of funds and private keys or passwords to access them. While fiat currencies are transferred privately using bank routing numbers and individuals’ account numbers, crypto owners move funds between addresses registered in a public ledger known as the blockchain.
Cryptocurrency wallets offer owners a measure of personal privacy and freedom from regulatory and tax oversight in some countries. But the blockchain is visible to the public, enabling law enforcement investigators and outside specialists to watch money move between addresses and through online exchanges and services where users can buy or sell collectibles or cash.
“We have developed a map of hundreds of millions of bitcoin addresses associated with illicit actors around the world,” said David Carlyle, director of policy and regulatory affairs at blockchain analytics firm Elliptic.
Once victims of ransomware transfer cryptocurrency to hackers, Carlisle said, complex criminal groups often distribute the funds among hundreds of other wallets. These transfers can include profit sharing with affiliate hackers who develop and rent ransomware, transfers to money launderers who clean illicit funds, or attempt to convert cryptocurrency into fiat currencies.
Colonial Pipeline provided investigators with the bitcoin address it paid the hackers on May 8, and released them on the road, according to court records filed in US District Court for the Northern District of California. Records show that the hackers moved the funds through at least six other addresses the next day.
On May 13, DarkSide told its affiliates that its servers and other infrastructure had been taken over, but did not specify where or how. On May 27, court records show, an amount including 63.7 bitcoins traced to Colonial ransom landed at the final address, with the FBI this week seizing that portion of the funds.
Share your thoughts
Should the government prevent companies from making ransom payments to hackers? Why and why not? Join the conversation below.
The FBI said in its warrant request on Monday that its investigators had the private key to that address. Officials did not say how it obtained the information, and the spokesman offered no further comment.
Pamela Clegg, director of financial investigations and education at blockchain analytics firm CipherTrace, said the amount recovered by the FBI likely represented part of the ransom that was shared with DarkSide affiliates. It added that on May 13, the same day DarkSide claimed its servers had been hacked, the remaining funds from Colonial that had not been recovered by the FBI were combined with other crypto linked to ransom payments in a wallet that now holds about 108 bitcoins. .
“Everyone has their eyes on it to see if this money has been transferred,” Ms Clegg said of the wallet.
FBI officials say the methods they used to recover some of Colonial’s money could be used in future cases, including when hackers attempt to transfer cryptocurrency across unfriendly overseas jurisdictions.
“Overseas is not a problem for this technology,” said Mr. Chan of the FBI field office in San Francisco.
– Sadie Gorman and Dustin Falls contributed to this article.
Cyber attacks and business
Write to David Uberti at [email protected]
Copyright © 2020 Dow Jones & Company, Inc. all rights are save. 87990cbe856818d5eddac44c7b1cdeb8
.
[ad_2]
Picture Credit!