Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

US Offers $10 Million Bounty in Hunt for DarkSide Ransomware Operators

US Goverment Offers $10 Million Reward for Data on Leaders and Members of DarkSide Ransomware Operation

US Goverment Offers $10 Million Reward for Data on Leaders and Members of DarkSide Ransomware Operation

The U.S. government wants to find the people responsible for the Colonial Pipeline ransomware attack and it’s putting up multi-million rewards for data on the operators behind the DarkSide extortion campaign.

The Department of State on Thursday offered up to $10 million for information leading to the identification or location of senior members of the DarkSide gang that caused major gas disruptions earlier this year.

In addition, the U.S. State Department is offering a reward of up to $5 million for information leading to the arrest and/or conviction in any country “of any individual conspiring to participate in or attempting to participate in a DarkSide variant ransomware incident.”

In a statement, the State Department said the DarkSide ransomware group was responsible for the Colonial Pipeline Company ransomware incident in May 2021, which led to the company’s decision to proactively and temporarily shut down the 5,500-mile pipeline that carries 45 percent of the fuel used on the East Coast of the United States. 

“In offering this reward, the United States demonstrates its commitment to protecting ransomware victims around the world from exploitation by cyber criminals,” it added. “The United States looks to nations who harbor ransomware criminals that are willing to bring justice for those victim businesses and organizations affected by ransomware.”

[ READ: REvil Ransomware Gang Hit by Law Enforcement Hack-Back ]

The rewards are being offered under the Department of State’s Transnational Organized Crime Rewards Program (TOCRP).

The latest reward offer follows a recent law enforcement operation against the REvil ransomware gang and signals an aggressive new approach to fighting back against the ransomware epidemic.

In that operation, the Tor servers associated with the REvil ransomware gang were seized in what was described as a “multi-country” hack-back operation that remains active.

The ransomware group’s public blog, which was used to name-and-shame organizations into paying multi-million data recovery ransoms, was knocked offline. A goodbye message from one of the operators read: “The server was compromised, and they were looking for me. Good luck, everyone; I’m off,” 

Threat hunters tracking underground human-operated ransomware operations confirmed the REvil shutdown, which was carried out by foreign partner of the U.S. government.

Several other competing ransomware groups responded to the REvil network takeover by moving cryptocurrency reserves and even publicly complaining about the hack-back operation.

[ READ: Colonial Pipeline CEO Explains $4.4M Ransomware Payment ]

The infamous REvil gang was caught using the Darkside data encryption tool in human-operated ransomware attacks against multiple U.S. companies. These included the Colonial Pipeline cyberattack that forced a shutdown of gas stations and the Kaseya supply-chain compromise.

The U.S. government recently identified approximately $5.2 billion in outgoing Bitcoin transactions that are potentially linked to ransomware payments, mostly to cybercriminal gangs in Russia and Eastern Europe.

Related: REvil Ransomware Gang Hit by Law Enforcement Hack-Back

Related: Black Hat 2021: New CISA Boss Unveils Anti-Ransomware Collab

Related: DarkSide Ransomware Shutdown: An Exit Scam or Running for Hills

Related: Colonial Pipeline CEO Explains $4.4M Ransomware Payment

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

Cyberwarfare

Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Nation-State

The North Korean APT tracked as TA444 is either moonlighting from its previous primary purpose, expanding its attack repertoire, or is being impersonated by...

Cybercrime

The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.