The US Justice Department announced Monday that it had recovered more than half of the $4.4 million paid by Colonial Pipeline to Russia-based ransomware extortionists Darkside, who had forced the shutdown of a major fuel network.
“Today, we turned the tables on Darkside by going after the entire ecosystem that fuels ransomware and digital extortion attacks, including criminal proceeds in the form of digital currency,” said Deputy Attorney General Lisa Monaco.
The seizure came one month after the group gave the US government a security scare by breaking into the computer systems of Colonial and forcing the shutdown of its 5,500 mile (8,850 kilometers) pipeline serving much of the eastern United States.
The cyberattack caused short-term fuel shortages and drew attention to the broader threat that the burgeoning ransomware “industry” posed to essential infrastructure and services.
The Justice Department said the US Federal Bureau of Investigation was able to track the 75 bitcoin Colonial paid in ransom — $4.4 million at the time — as it moved through multiple anonymous transfers.
Eventually, it was able to seize from a cryptocurrency wallet 63.7 bitcoin, which due to the digital currency’s fall over the past month, was only worth $2.3 million on Monday.
Colonial boss Joseph Blount thanked the FBI for its “swift work and professionalism,” saying the company had “quietly and quickly” contacted its agents when the attack was detected on May 7.
“Holding cybercriminals accountable and disrupting the ecosystem that allows them to operate is the best way to deter and defend against future attacks,” he said in a statement.
It was the first seizure of a paid ransom by the Justice Department’s new Ransomware and Digital Extortion Task Force, tasked to go after the so-called “ransomware as a service” industry that has extracted hundreds of millions of dollars from targets like schools, hospitals, local governments, and businesses over the past several years.
“Ransom payments are the fuel that propels the digital extortion engine, and today’s announcement demonstrates that the United States will use all available tools to make these attacks more costly and less profitable for criminal enterprises,” said Monaco.
Monaco gave no details on how the money was recovered from Darkside, but analysts believe it could have involved both FBI investigators and possibly the US military’s offensive cyber warfare operations.
One week after Colonial was forced to shut its operations on May 7, an online comment believed to be by Darkside operator “Darksupp” admitted that it had lost control of part of its operating infrastructure, including payment and other servers, and that ransom payments had been removed from its servers.
Its dark-web site also went down.
