DarkSide hackers have raked in more than $90 million in Bitcoin
The hacking group responsible for the Colonial Pipeline hack has made roughly $1.9 million per victim
The DarkSide ransomware group, which is thought to be behind the attacks on the Colonial pipeline, has made around $90 million in Bitcoin from 47 victims.
According to cyber security firm Elliptic's co-founder and chief scientist Tom Robinson, victims made just over $90 million in Bitcoin ransom payments to DarkSide, originating from 47 distinct wallets. According to DarkTracer, DarkSide ransomware has infected 99 organizations, which suggests that around 47% of victims paid a ransom, and the average payment was $1.9 million.
“To our knowledge, this analysis includes all payments made to DarkSide, however further transactions may yet be uncovered, and the figures here should be considered a low bound,” said Robinson.
Cyber criminal gangs such as DarkSide have established a ransomware-as-a-service business model where they develop the malware but allow other hackers to breach victims. DarkSide then splits the proceeds between themselves and their affiliates.
In DarkSide’s case, the developer reportedly takes 25% for ransoms less than $500,000, but this decreases to 10% for ransoms greater than $5 million.
Blockchain analysis makes money split clear, with the different shares going to separate Bitcoin wallets controlled by the affiliate and developer.
RELATED RESOURCE
Defend your organisation from evolving ransomware attacks
Learn what it takes to reduce risk and strengthen operational resiliency
Robinson said the DarkSide developer has received Bitcoins worth $15.5 million (17%), with the remaining $74.7 million (83%) going to the various affiliates.
Further analysis allowed the firm to see where the cryptocurrency was being spent or exchanged. Most of the funds were sent to cryptoasset exchanges, where they can swap them for other cryptoassets, or fiat currency, said Robinson.
Robinson said that most cryptoasset exchanges comply with anti-money laundering (AML) regulations, verifying customers’ identity, and reporting suspicious activity, such as ransomware proceeds.
“However, some jurisdictions do not enforce these regulations, and it is to exchanges in these locations that much of the DarkSide ransomware proceeds are being sent,” said Robinson.
The DarkSide ransomware group, believed to be based in Eastern Europe or Russia, has recently disbanded after further investigations by US law enforcement. An email to DarkSide’s affiliates said that it was shutting up shop “due to the pressure of the US.”
However, many criminal gangs have been said they are disbanding only to show up again weeks or months later under a new name.
-
Are small language models finally having their moment?In-depth The smallest AI models can be run on a mobile phone or laptop – what's the business potential?
-
‘Reducing reliance on foreign tech infrastructure is key’ to European tech success – and its long-term survivalNews MEPs have once again called for decreased reliance on foreign tech infrastructure
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in lifeNews With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacksNews Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Ransomware gangs are sharing virtual machines to wage cyber attacks on the cheap – but it could be their undoingNews Thousands of attacker servers all had the same autogenerated Windows hostnames, according to Sophos
-
Google issues warning over ShinyHunters-branded vishing campaignsNews Related groups are stealing data through voice phishing and fake credential harvesting websites
-
The FBI has seized the RAMP hacking forum, but will the takedown stick? History tells us otherwiseNews Billing itself as the “only place ransomware allowed", RAMP catered mainly for Russian-speaking cyber criminals
-
Everything we know so far about the Nike data breachNews Hackers behind the WorldLeaks ransomware group claim to have accessed sensitive corporate data
-
There’s a dangerous new ransomware variant on the block – and cyber experts warn it’s flying under the radarNews The new DeadLock ransomware family is taking off in the wild, researchers warn
-
Hacker offering US engineering firm data online after alleged breachNews Data relating to Tampa Electric Company, Duke Energy Florida, and American Electric Power was allegedly stolen
