Pipeline Ransom Has Been Paid

The Colonial Pipeline company has paid $5 million to the DarkSide, a criminal hacking group, to restore operations after a ransomware attack paralysed fuel supplies across the US eastern seaboard. 

DarkSide are the suspected Russian-based group that the FBI has said was responsible for the attack, has told its affiliates it is 'closing its services', according  to FireEye, the leading cyber security group appointed to investigate the incident. 

Experts are warning that ransomware attacks, which are partly ransom, partly blackmail, are becoming more frequent, as the often Russia-based hackers are becoming more sophisticated with their hacking cyber attacks which have hit power generation, federal and local government agencies, water treatment plants and even police departments across the US.

Hit by a cyber attack, the operator of a major US fuel pipeline was forced to shut down service that is currently causing gas shortages throughout the Southeast. And the US sanctioned the Kremlin recently for a hack of federal government agencies, known as the SolarWinds breach, that officials have linked to a Russian intelligence unit and characterised as an intelligence-gathering operation.

As the US was focused on the pipeline attack, another hacker group hit the Washington DC Metro Police.  A day after US President Joe Biden said the US plans to disrupt the hackers behind the Colonial Pipeline cyber attack, the operator of the Darkside ransomware said the group lost control of its web servers and some of the funds it made from ransom payments. “A few hours ago, we lost access to the public part of our infrastructure, namely: Blog. Payment server. CDN servers,” said Darksupp, the operator of the Darkside ransomware in a post.  “Now these servers are unavailable via SSH, and the hosting panels are blocked,” said the Darkside operator while also complaining that the web hosting provider refused to cooperate.

In addition, the Darkside operator also reported that crypto currency funds were also withdrawn from the gang’s payment server, which was hosting ransom payments made by victims. 

The funds, which the Darkside gang was supposed to split between itself and its affiliates were transferred to an unknown wallet, Darksupp said.

Background

One of the first known cases involving Darkside ransomware occurred in late August 2020. The victim was a Canadian construction firm, which  refused to pay the ransom and instead restored their data and systems from backups.  Another company, hit with the Darkside ransomware around the same time, did pay the ransom, $2 million. The Darkside ransomware locked about 5,000 of the company’s computers and servers, including data backups that they’d kept online. According to Stephen Boyce, a former FBI investigator then working for the US security company Crypsis who led the team that investigated the infection. “Our victim paid, so they were not publicly named and/or shamed,” The the victim was a privately held US-based holding company, which Boyce declined to name.   

FireEye has published a detailed timeline of DarkSide’s movements, revealing that threat actors have “become more proficient at conducting multifaceted extortion operations”, adding that this success has “directly contributed to the rapid increase in the number of high-impact ransomware incidents over the past few years”.and they expect to see varying extortion techniques leveraging DarkSide malware that “will continue to evolve throughout 2021”.

Biden Orders Better Cyber Defence

President  Biden has now signed an Executive Order to improve US cyber defences in light of recent attack meant to strengthen US cybersecurity defences in response to a series of headline-grabbing hacking incidents that highlight how vulnerable the country''s public and private sectors are to high-tech spies and criminals operating from half a world away. Since December, the US has been on the receiving end of three of the worst cyber-attacks in history, each one different, as if testing the administration in different ways.

The order comes as the administration has been grappling with its response to a massive breach by Russia of federal agencies and ransomware attacks on private corporations.

The detailed order issues strict deadlines for all government departments to tighten security. It comes as the US deals with a hack on the country's biggest pipeline that has seen fuel shortages and panic-buying across multiple states. Colonial Pipeline says it has restarted its pumps but it will be "several days" until fuel supplies return to normal.

FireEye:    Recorded Future:     Guardian:     Zero Day:   Portswigger:     

 Bloomberg:      BBC:     DTNext:    TEISS:     Image: Unsplash

You Might Also Read:

Running Out Of Cyber Gas:

 

« Stop Taking Risks Online
The Next E-Industrial Revolution »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Omerta

Omerta

Omerta is a global security technology and services company. We advise, consult, design, build, mitigate, protect, manage, provide and train to protect from increasing cyber threats.

Centre for International Governance Innovation (CIGI)

Centre for International Governance Innovation (CIGI)

CIGI research areas include Conflict Management & Security which encompass cyber security and cyber warfare.

Intland Software

Intland Software

Intland offer an integrated Application Lifecycle Management platform that offers all-round Requirements, Development, and Testing & Quality Assurance functionality.

Combitech

Combitech

Combitech is the Nordic region’s leading cyber security consultancy firm, with about 260 certified security consultants helping companies and authorities prevent and manage cyber threats.

Jamcracker

Jamcracker

Jamcracker is a cloud services management and cloud governance solutions company, with more than a decade of experience providing industry leading software and services.

CSI

CSI

CSI is a Managed Service Provider (MSP) delivering Hybrid Multi-Cloud, Data Protection, and Cyber Security solutions to highly regulated industries.

Curricula

Curricula

Curricula's cyber security awareness training delivers short relatable security stories to your employees. We make learning cyber security simple and fun.

Dell Technologies Capital

Dell Technologies Capital

At Dell Technologies Capital we lead investment in disruptive, early-stage startups in enterprise and cloud infrastructure.

BigPanda

BigPanda

BigPanda is the first provider of Autonomous Operations solutions that empower IT Operations at large, complex enterprises.

Cyber Command - Romania

Cyber Command - Romania

Cyber Command represents the military authority responsible for the development, protection and resilience of military IT networks and services that support the Romanian Force Structure.

Chartered Institute of Information Security (CIISec)

Chartered Institute of Information Security (CIISec)

CIISec is dedicated to helping individuals and organisations develop capability and competency in cyber security.

WheelHouse IT

WheelHouse IT

WheelHouse IT secures, manages, and advances businesses with innovative, cost-effective IT solutions.

Cylab - Carnegie Mellon University

Cylab - Carnegie Mellon University

Carnegie Mellon University CyLab is the University's security and privacy research institute.

Fairdinkum Consulting

Fairdinkum Consulting

Fairdinkum is a leading full-service IT consulting firm with more than two decades of experience in the industry.

Brunswick Group

Brunswick Group

Brunswick is a critical issues firm. We advise the world’s leading companies on how to navigate the critical issues they face and engage with their critical stakeholders.

Alchemy Security Consulting

Alchemy Security Consulting

Alchemy Security Consulting specialise in offensive and defensive cyber security. We find the weak link in your security so you can patch it up fast and avoid being hacked.