The US Treasury has identified approximately $5.2 billion in outgoing Bitcoin transactions likely to be tied to the top 10 most commonly reported ransomware payments over a ten year period.
The Treasury’s Crimes Enforcement Network (FinCEN) identified and analysed 177 convertible virtual currency (CVC) wallet addresses used for ransomware-related payments by analysing 2,184 Suspicious Activity Reports (SARs) filed between 1 January 2011 and 30 June 2021, it said in a report.
Based on blockchain analysis of transactions with the 177 CVC wallet addresses, FinCEN identified around $5.2 billion in outgoing Bitcoin transactions that may have been tied to ransomware payments.
Linking the transactions to this year, FinCen found that between 1 January and 30 June 2021, the number of ransomware-related SARs filed monthly has grown rapidly, with 635 SARs filed and 458 transactions reported during the first half of the year. This is a 30% increase from the total 487 SARs filed for the entire 2020 year. For the first six months of this year, the total value of suspicious activity reported was $590 million, exceeding the $416 million reported the previous year.
“FinCEN analysis of ransomware-related SARs filed during the first half of 2021 indicates that ransomware is an increasing threat to the US financial sector, businesses, and the public,” said the report.
RELATED RESOURCE
The best defence against ransomware
How ransomware is evolving and how to defend against it
Although Bitcoin was the most common ransomware-related payment method in reported transactions, FinCEN found the mean average total monthly suspicious amount of ransomware transactions was $66.4 million and the median average was $45 million.
It identified 68 ransomware variants reported in SAR data for transactions, with the most commonly reported being REvil/Sodinokibi, Conti, DarkSide, Avaddon, and Phobos. It also found a number of money laundering typologies common among the variants, including threat actors requesting money in Anonymity-enhanced Cryptocurrencies (AECs) and avoiding reusing wallet addresses, “chain hopping” and cashing out at centralised exchanges, and using mixing services and decentralised exchanges to convert proceeds.
This comes after the US Department of the Treasury imposed sanctions on a virtual currency exchange in September over its alleged role in facilitating financial transactions for ransomware actors. Suex, the exchange, had allegedly facilitated transactions involving proceeds from at least eight ransomware variants.
-
The unseen risk in Microsoft 365: disaster recoveryBusinesses that assume they’re covered for data backup could come unstuck in a time of crisis
-
Anthropic CEO Dario Amodei's prediction about AI in software development is nowhere nearly to becoming a realityNews In March, Anthropic CEO Dario Amodei claimed up to 90% of code would be written by AI within six months – his prediction hasn't quite come to fruition.
-
Prolific ransomware operator added to Europe’s Most Wanted list as US dangles $10 million rewardNews The US Department of Justice is offering a reward of up to $10 million for information leading to the arrest of Volodymyr Viktorovych Tymoshchuk, an alleged ransomware criminal.
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attackNews The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalitiesNews The attack on IT systems supplier Miljödata has impacted public sector services across the country
-
A notorious hacker group is ramping up cloud-based ransomware attacksNews The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b modelNews Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
