The US State Department ups the ante in its hunt for the ransomware perpetrators by offering a sizeable cash sum for locating & arresting leaders of the cyber-criminal group.
The federal government has upped the ante in its fight against ransomware by offering a $10m reward for information leading to the identification or location of leaders of the Dark Side ransomware group.
Black Matter
The US Department of State unveiled the reward on Thurs., adding a $5m reward for information that leads to the arrest & conviction of individuals participating in a Dark Side attack.
The news comes on the heels of an announcement by Black Matter, a derivative of the now shuttered ransomware gang Dark Side, which stated it would also be ceasing operations due to increased pressure from international law enforcement agencies.
Critical Infrastructure Under Attack
Dark Side is perhaps best known for its highly disruptive attack on Colonial Pipeline in May, which created upheaval in fuel supplies on the US East Coast as people began hoarding gas on the eve of Memorial Day weekend. The group is also believed to have been behind a ransomware attack against Toshiba.
Both groups’ focus on critical infrastructure is what has raised the hackles of international law-enforcement to a critical boiling point. Black Matter, which emerged in July, targeted 2 US agricultural cooperatives in the US in 1 week in Sept. alone–Iowa-based farmers feed & grain co-operative NEW Cooperative & Minnesota-based supply & grain marketing co-operative Crystal Valley.
Joe Biden
These attacks demonstrate a disregard of US President Joe Biden’s call for international leaders to shut down ransomware groups. Increased pressures, according to officials, have only sent criminals deeper into the shadows.
There has been a measure of success. The servers from the prolific ransomware group, REvil, went dark days after Biden asked for international action by countries such as Russia.
Global Ransomware Crackdown
“In offering this reward, the US demonstrates its commitment to protecting ransomware victims around the world from exploitation by cyber criminals,” the Department of State stated in its release.
The Dept. is offering the reward under the Department of State’s Transnational Organised Crime Rewards Program (TOCRP), which it manages with US Federal law enforcement partners as part of the govt.’s effort to disrupt & dismantle international crime syndicates.
International Authorities
International authorities already have made significant progress in apprehending those responsible for ransomware. Just last week Europol apprehended 12 individuals allegedly responsible for “wreaking havoc across the world with ransomware attacks against critical infrastructure,” according to an agency press release. In fact, it’s those arrests are what caused Black Matter to shut down.
Early last month Interpol arrested members of a ransomware gang believed to be REvil in Ukraine, with investigators in Germany revealing the identity of the group’s leader shortly after in an effort to grab him as well.
Sweetening the Deal
The reward offered by Department of State should serve to bolster these law-enforcement efforts, according to security professionals. Jake Williams, co-founder & CTO at incident response firm Breach Quest, even noted that offering financial incentive to capture ransomware criminals is “long overdue.”
The reward also capitalises on the ransomware as a service (RaaS) crime model that many ransomware groups—Dark Side/Black Matter included–use to tap affiliates to carry out their activities, he added.
Affiliate Model
“As ransomware operators have adopted an affiliate model for operations, the number of people they must place trust in, even at arm’s length, has increased dramatically,” Williams explained. “With rewards this large, there’s a substantial incentive for these criminals to turn on one another.”
Several professionals compared the $10m bounty to the $25m that the US offered to help authorities track down Al-Qaeda terrorist leader Osama bin Laden, noting that the sizeable sum shows commitment.
“It does illustrate how important this information might be, especially since the incentive is enough that it potentially turns friends into foes,” outlined Sean Nikkel, Senior Cyber Threat Intel Analyst at digital risk protection firm Digital Shadows.
Shut Down
Federal incentives from govts. could be a crucial step into pushing the international crime-fighting effort needed to shut down ransomware gangs for good, noted another security professional.
“Bounties encourage collaboration & intelligence sharing, which increases jeopardy for the attacker and may cause them to think again,” Danny Lopez, CEO for security firm Glasswall, concluded
https://www.cybernewsgroup.co.uk/virtual-conference-november-2021/
