FBI Claws Back Millions of DarkSide’s Ransom Profits

United States law enforcement has clawed back approximately $2.3 million of the ransom allegedly paid to DarkSide by Colonial Pipeline last month, the Department of Justice (DOJ) and FBI announced in a joint press conference on Monday.

“Today we turned the tables on DarkSide,” FBI Deputy Director Paul Abbate said in live-streamed remarks.

They seized the money – in the form of 63.7 bitcoins – by reviewing the Bitcoin public ledger, as the DOJ described in a press release. Law enforcement tracked multiple transfers of bitcoin and were able to identify that about 63.7 of the bitcoins paid by Colonial Pipeline Co. after the May 7 ransomware attack were transferred to a specific address – an address that the FBI controls.

“Law enforcement was able to track multiple transfers of bitcoin and identify that approximately 63.7 bitcoins, representing the proceeds of the victim’s ransom payment, had been transferred to a specific address, for which the FBI has the ‘private key,’ or the rough equivalent of a password needed to access assets accessible from the specific Bitcoin address,” according to the DOJ’s press release. “This bitcoin represents proceeds traceable to a computer intrusion and property involved in money laundering and may be seized pursuant to criminal and civil forfeiture statutes.”

In fact, the FBI laid the snare from the get-go, when Colonial alerted the bureau to the attack, the DOJ said during Monday’s press conference. In that attack, the DarkSide ransomware-as-a-service (RaaS) gang seized Colonial’s systems, forcing Colonial – a major provider of liquid fuels to the East Coast – to temporarily halt all pipeline operations.

The shutdown sent fuel prices skyrocketing and prompted fuel stockpiling, as images of people piling plastic bags full of gas or stacking fuel containers in their car trunks made the rounds on social media. The ransomware attack also triggered the Biden administration to issue an emergency declaration that covered 17 states and Washington D.C.

Perhaps the tables were turned, but only about half-way: Colonial reportedly shelled out $5 million in ransom to DarkSide. Do the math, and it means that the DarkSide threat actors still walked away with about half of the cryptocurrency. Given that the group is believed to be located in Russia, they’re also unlikely to face criminal action on the part of the US government.

Hit ‘Em Where It Hurts

But, as Abbate pointed out and all those in attendance at the press conference emphasized, law enforcement did manage to deprive DarkSide of what the group is after: Namely, profit. DarkSide said the same thing early on in this, the attack that sent out still-spreading ripples: they were after profit, not to disrupt critical infrastructure. The gang asserted in a statement that they’re “apolitical” and don’t want to be tied to any government activity or disruptions.

Or, to put it more succinctly, as many observers saw it, DarkSide didn’t know what it was getting itself into, making the Colonial attack a “very big oops”, as one security expert put it. DarkSide was paralyzed itself a week after the attack: Its operators announced that they had lost access to the public part of the group’s infrastructure. Specifically, the servers for its blog, payment processing and denial-of-service (DoS) operations had been seized. DarkSide didn’t specify the country in which those servers operated or whose law enforcement seized them.

Turning Off the Bitcoin Tap

“Following the money remains one of the most basic, yet powerful tools we have,” Deputy Attorney General Lisa O. Monaco was quoted as saying in the press release. “Ransom payments are the fuel that propels the digital extortion engine, and today’s announcement demonstrates that the United States will use all available tools to make these attacks more costly and less profitable for criminal enterprises. We will continue to target the entire ransomware ecosystem to disrupt and deter these attacks.”

The task force that handled the Bitcoin seizure included the Special Prosecutions Section and Asset Forfeiture Unit of the U.S. Attorney’s Office for the Northern District of California, with assistance from the DOJ Criminal Division’s Money Laundering and Asset Recovery Section and Computer Crime and Intellectual Property Section, and the National Security Division’s Counterintelligence and Export Control Section. It was coordinated through the DOJ’s Ransomware and Digital Extortion Task Force, which was created to combat the growing number of ransomware and digital extortion attacks. In fact, the DarkSide seizure was the task force’s first action.

Monday’s announcement demonstrates how crucial it is to notify law enforcement early on if an organization is targeted with ransomware, Monaco said, thanking Colonial for doing just that: Quickly notifying the FBI when the company learned that it had been targeted by DarkSide.

Download our exclusive FREE Threatpost Insider eBook, “2021: The Evolution of Ransomware,” to help hone your cyber-defense strategies against this growing scourge. We go beyond the status quo to uncover what’s next for ransomware and the related emerging risks. Get the whole story and DOWNLOAD the eBook now – on us!