(WASHINGTON) — The Justice Department has recovered most of a multimillion-dollar ransom payment made to hackers after a cyberattack that caused the operator of the nation’s largest fuel pipeline to halt its operations last month, officials said Monday.
The operation to seize cryptocurrency paid to the Russia-based hacker group is the first of its kind to be undertaken by a specialized ransomware task force created by the Biden administration Justice Department.
[…]
Colonial officials have said they took their pipeline system offline before the attack could spread to its operating system, and decided soon after to pay ransom of 75 bitcoin — then valued at roughly $4.4 million — in hopes of bringing itself back online as soon as it could. The company’s president and chief executive, Joseph Blount, is set to testify before congressional panels this week.
[…]
The Bitcoin amount seized — 63.7, currently valued at $2.3 million after the price of Bitcoin tumbled— amounted to 85% of the total ransom paid, which is the exact amount that the cryptocurrency-tracking firm Elliptic says it believes was the take of the affiliate who carried out the attack. The ransomware software provider, DarkSide, would have gotten the other 15%.
“The extortionists will never see this money,” said Stephanie Hinds, the acting U.S. attorney for the Northern District of California, where a judge earlier Monday authorized the seizure warrant.
[…]
Source: DOJ Recovers Most of Colonial Pipeline Hack Ransom | Time
[…]
Despite paying for the ransom, the encryption tools handed over did not work or help the company’s efforts to restore its systems.
The Justice Department obtained a warrant from a California district court on Monday in order to seize the money.
“Following the money remains one of the most basic, yet powerful tools we have,” Monaco said. “Today’s announcements also demonstrate the value of early notification to law enforcement; we thank Colonial Pipeline for quickly notifying the FBI when they learned that they were targeted by DarkSide.”
[…]
Colonial Pipeline faced significant backlash for paying the ransom but the FBI and Justice Department said they were able to use the Bitcoin public ledger to trace the payments back to “a specific address, for which the FBI has the ‘private key,’ or the rough equivalent of a password needed to access assets accessible from the specific Bitcoin address.”
[…]
“We cannot guarantee and we may not be able to do this in every instance.”
Source: ‘Majority’ of ransom paid by Colonial Pipeline seized and returned by DOJ | ZDNet
Robin Edgar
Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft