The DarkSide ransomware group, which is thought to be behind the attacks on the Colonial pipeline, has made around $90 million in Bitcoin from 47 victims.
According to cyber security firm Elliptic's co-founder and chief scientist Tom Robinson, victims made just over $90 million in Bitcoin ransom payments to DarkSide, originating from 47 distinct wallets. According to DarkTracer, DarkSide ransomware has infected 99 organizations, which suggests that around 47% of victims paid a ransom, and the average payment was $1.9 million.
“To our knowledge, this analysis includes all payments made to DarkSide, however further transactions may yet be uncovered, and the figures here should be considered a low bound,” said Robinson.
Cyber criminal gangs such as DarkSide have established a ransomware-as-a-service business model where they develop the malware but allow other hackers to breach victims. DarkSide then splits the proceeds between themselves and their affiliates.
In DarkSide’s case, the developer reportedly takes 25% for ransoms less than $500,000, but this decreases to 10% for ransoms greater than $5 million.
Blockchain analysis makes money split clear, with the different shares going to separate Bitcoin wallets controlled by the affiliate and developer.
RELATED RESOURCE
Defend your organisation from evolving ransomware attacks
Learn what it takes to reduce risk and strengthen operational resiliency
Robinson said the DarkSide developer has received Bitcoins worth $15.5 million (17%), with the remaining $74.7 million (83%) going to the various affiliates.
Further analysis allowed the firm to see where the cryptocurrency was being spent or exchanged. Most of the funds were sent to cryptoasset exchanges, where they can swap them for other cryptoassets, or fiat currency, said Robinson.
Robinson said that most cryptoasset exchanges comply with anti-money laundering (AML) regulations, verifying customers’ identity, and reporting suspicious activity, such as ransomware proceeds.
“However, some jurisdictions do not enforce these regulations, and it is to exchanges in these locations that much of the DarkSide ransomware proceeds are being sent,” said Robinson.
The DarkSide ransomware group, believed to be based in Eastern Europe or Russia, has recently disbanded after further investigations by US law enforcement. An email to DarkSide’s affiliates said that it was shutting up shop “due to the pressure of the US.”
However, many criminal gangs have been said they are disbanding only to show up again weeks or months later under a new name.
-
Upcoming webinars not to be missedWebinar Sign up for these free webinars to help inform decision-making and get the most value out of IT today and tomorrow
-
‘Polyworking’ is a cybersecurity nightmare waiting to happenNews Particularly popular with Gen Z, so-called polyworking brings huge cybersecurity risks
-
The Scattered Spider ransomware group is infiltrating Slack and Microsoft Teams to target vulnerable employeesNews The group is using new ransomware variants and new social engineering techniques - including sneaking into corporate teleconferences
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crimeNews A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaosNews Thousands of ransomware cases have already been posted on the dark web this year
-
Everything we know about the Ingram Micro cyber attack so farNews A cyber attack on Ingram Micro severely disrupted operations and has been claimed by the SafePay ransomware group.
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culpritsNews Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackersNews While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker groupNews An analysis of May's SQL database dump shows how much LockBit was really making
