Tackling Ransomware as a Service

Four weeks later, the US Department of Justice announced that it had recovered most of the bitcoin that had been paid by Colonial to Darkside. The FBI has not disclosed exactly how it extracted the ransom from the extortionist gang’s digital wallet. But here is what we do know: All bitcoin transactions, even ransoms paid to hackers, are duly recorded on the blockchains that store data in blocks that are then chained together. Put simply, blockchains provide digital footprints that can be traced back to people or parties on both sides of a cryptocurrency transaction.

Colonial was not alone. Among recent ransomware attacks, the world’s largest meatpacker JBS, the Irish national health service, and the ferry service to Martha’s Vineyard and Nantucket in Massachusetts have one thing in common with Colonial. They are all key cogs of critical infrastructure and are targeted because they are more likely to pay promptly. The biggest ransom ever paid was by US travel management company CWT Global, which handed over US$4.5 million in bitcoin to the Ragnar Locker gang in July 2020. Attackers like Darkside, Avaddon, Netwalker and REvil are increasingly using sophisticated ransomware techniques to shake down unwary and unprepared businesses, public institutions and government agencies.

Rise in ransomware attacks

Most attacks start by installing Cobalt Strike beacons in the computers of their targets to proactively test their defenses against advanced tactics and procedures. The beacons give attackers like Darkside access to the network. Once they have gained a foothold inside the IT network of the firm, they can easily steal data and deploy their ransomware.

As of mid-June, there had been over 90 reported ransom attacks this year alone. That is a 60% surge over the past 12 months. Most ransomware attacks go unreported because companies, particularly publicly listed ones, do not want investors to know that they are paying ransom. While most news reports focus on million-dollar ransoms being paid to big companies, small- to mid-sized businesses are at the largest risk, with ransom demands regularly hitting six or seven figures. By the way, the average ransom payment doubled over the past year, according to Coveware, a Connecticut-based cybersecurity consultancy. About 56% of ransomware victims paid a ransom last year, according to global security company Kaspersky. Most of the big firms, or those in sensitive sectors like infrastructure, pay up immediately.

The business of ransomware is more than just a bunch of hackers in some Moscow basement coding software that allows them to hack a website in Texas or or London or Tokyo, extracting info and then divvying up the money among themselves. It is a far more complex undertaking. It requires detailed planning, teamwork and precision execution. Ransomware gangs sometimes use dozens of software and digital security experts who plan a major attack, divide the work and — when the attack is successful — get paid in accordance with the value they had provided. There are people who scout targets for ransomware attacks. People who know what sort of companies are vulnerable, like Colonial which cannot afford to have its pipelines shut off for too long yet did not spend enough on cybersecurity to protect themselves from a coordinated attack. Other affiliates are recruited to publicise previous victims to pressure new victims into paying for the stolen data. It takes weeks, sometimes months, of meticulous planning to launch a successful attack.

The proceeds from ransomware are shared between attack administrators like Darkside and their partners, or affiliates, who provide access to organizations and deploy the ransomware. RaaS administrators can take up to 25% of the ransom for attacks that generate less than US$500,000. The figures decrease to 10% for ransoms greater than US$5 million.

The attackers or administrators or the core gang use affiliates to rent the use of ransomware strains like Cobalt Strike from their creators on the dark web. Before a big attack such as Colonial Pipeline, the organisers, like Darkside which is overseeing the operations, place ads across the dark web asking for help in an upcoming operation. The creators of ransomware and other services get a cut of the ransom from each successful attack from Darkside for the tools or services they provide.

It is not just ransomware that a gang like Darkside or REvil is renting in the process of carrying out a successful attack. Successful execution requires coordination and teamwork. Darkside might need illicit cloud services to store stolen data from Colonial. It can’t just approach Amazon.com’s outgoing CEO and say, “Hey, Jeff Bezos, can you spare space on AWS?” It may need payment software and digital wallets. It can’t just call up Jack Dorsey, former CEO of payments giant Square and ask for his help. It may need a whole suite of money laundering services as well as a bunch of hackers who actually carry the attack. These services cost money and require teams that execute to perfection in a timely manner.

Think of the Ransomware administrator like Darkside or Ragnar Locker the way you might think of a contractor who supervises the construction of a building. He has to hire plumbers, electricians, wall painters and indeed oversee an entire supply chain making sure steel, cement, paints as well as all the necessary fixtures and fittings get to the site on time and the whole system operates like clockwork. The contractor often collects the biggest chunk of the money but he can’t do it all himself. He relies on others who have to be paid their fair share so he can keep constructing other buildings and keep making money. Darksides of the world are just ransomware administrators or a contractor at the apex of a complex ecosystem of bad actors helping in a great heist.

And teams are not just located in basements around suburban Moscow. They have huge support infrastructure around the world — Europe, Asia, America and Africa to whom they outsource key parts of the work. But as often in organised crime, most people in the ecosystem do not know the whole details of the attack plan. They just know the role they are supposed to play and get paid for doing their part. It may have begun with an individual rogue hacker or a gang of mates in some basement in Moscow or Shanghai or Tehran, but the ransomware industry is now a well-heeled machine in which everyone knows their role.

Looking ahead

How was the Darkside gang caught by the FBI? What does it all mean for future ransomware attacks? Will the hackers now abandon bitcoin and other crypto currencies that leave footprints on the blockchain or will they merely be more careful? In the aftermath of the FBI's raid of Darkside’s wallet to recover the ransom, new attacks have continued unabated. After all, the use of marked currency notes to pay ransom in kidnappings around the world hasn’t ended crimes like that. Where there is money, thieves just keep finding new ways to steal it.

After every reported ransomware attack law enforcement agencies try to learn about how the hackers operate — how they attack the website, what they steal, how they blackmail companies and force them into paying ransom, how they collect ransom in cryptocurrencies and how the proceeds are distributed across the vast ransomware supply chain. Cryptocurrencies have allowed governments to dig deeper into where the ransom money goes and enable enforcement agencies to understand who does the real gruntwork behind the ransomware attack and how much that work is worth to the ransomware administrators like Darkside.

While cryptocurrencies like Bitcoin have long been used in money laundering as well as other crimes like ransomware or by rogue states to fund espionage, terrorism or get paid for their nefarious activities, only in the past year or so, the scale of crypto transactions have become so huge that law enforcement agencies around the world have actively begun to use and harvest the blockchain to scour such transactions, track down culprits and indeed disrupt those business. Even before the advent of cryptocurrencies, it was not unheard of for thieves to get caught and for their loot, or part of it, recovered.

In the aftermath of the Colonial attack, the White House described ransomware as a major national security threat and even compared it to the 9/11 terrorist attack 20 years ago. If you speak to cybersecurity experts and consultants (and I have spoken to several of them in recent weeks), they will tell you that while there are very real threats to business and security from state actors — Russia, China, Iran and North Korea etc — the key threat is cybercriminals, some of whom may be known to their home governments even if all their work is not expressly being condoned by the leaders.

The big ransomware groups based in Russia are tolerated as long as they don’t threaten the interests of President Vladimir Putin’s Administration. If they disrupt infrastructure in North America or Europe they are just serving the interests of the Russian state. The solution might be to force Russia to own the growing ransomware problem. For their part, governments around the world should discourage the payment of ransoms, make it compulsory for such payments to be disclosed. So far, insurance companies have been happy to pay out ransom demands as long as premiums from new policies continue to grow. Insurers must discourage clients from promptly paying up ransom and moving on because that only encourages Darksides of the world to get ready for the next attack.

Ransomware is a serious global problem, far more serious than Somali pirates attacking cargo ships in Indian Ocean a decade ago. But it can be tackled. We just need different kinds of tools and skills to tackle cyber crimes. We need more effective monitoring of data, better anti-hacking software, better trained IT staffers with more sophisticated tools to disrupt the business model of ransomware gangs and the ever growing pool of enablers, affiliates and partners who help the likes of REvil or Darkside carry out the attacks and cripple key infrastructure.

On Friday, May 7, Colonial Pipeline, which accounts for more than half of all petrol and diesel supplies across the US East Coast, including New York, Boston and Miami, was targeted by Darkside, a Russian ransomware gang. Cyber criminals stole sensitive data which forced Colonial to shut its pipelines down, causing a spike in prices at the pump and long queues of cars and trucks trying to fill up their tanks. Darkside demanded US$4.4 million ($5.9 million) worth of Bitcoin as ransom. As any key infrastructure firm would have done, the pipeline operator promptly deposited Bitcoin in Darkside’s digital wallet and got its data back.

Four weeks later, the US Department of Justice announced that it had recovered most of the bitcoin that had been paid by Colonial to Darkside. The FBI has not disclosed exactly how it extracted the ransom from the extortionist gang’s digital wallet. But here is what we do know: All bitcoin transactions, even ransoms paid to hackers, are duly recorded on the blockchains that store data in blocks that are then chained together. Put simply, blockchains provide digital footprints that can be traced back to people or parties on both sides of a cryptocurrency transaction.

Colonial was not alone. Among recent ransomware attacks, the world’s largest meatpacker JBS, the Irish national health service, and the ferry service to Martha’s Vineyard and Nantucket in Massachusetts have one thing in common with Colonial. They are all key cogs of critical infrastructure and are targeted because they are more likely to pay promptly. The biggest ransom ever paid was by US travel management company CWT Global, which handed over US$4.5 million in bitcoin to the Ragnar Locker gang in July 2020. Attackers like Darkside, Avaddon, Netwalker and REvil are increasingly using sophisticated ransomware techniques to shake down unwary and unprepared businesses, public institutions and government agencies.

Most attacks start by installing Cobalt Strike beacons in the computers of their targets to proactively test their defenses against advanced tactics and procedures. The beacons give attackers like Darkside access to the network. Once they have gained a foothold inside the IT network of the firm, they can easily steal data and deploy their ransomware.

As of mid-June, there had been over 90 reported ransom attacks this year alone. That is a 60% surge over the past 12 months. Most ransomware attacks go unreported because companies, particularly publicly listed ones, do not want investors to know that they are paying ransom. While most news reports focus on million-dollar ransoms being paid to big companies, small- to mid-sized businesses are at the largest risk, with ransom demands regularly hitting six or seven figures. By the way, the average ransom payment doubled over the past year, according to Coveware, a Connecticut-based cybersecurity consultancy. About 56% of ransomware victims paid a ransom last year, according to global security company Kaspersky. Most of the big firms, or those in sensitive sectors like infrastructure, pay up immediately.

The business of ransomware is more than just a bunch of hackers in some Moscow basement coding software that allows them to hack a website in Texas or or London or Tokyo, extracting info and then divvying up the money among themselves. It is a far more complex undertaking. It requires detailed planning, teamwork and precision execution. Ransomware gangs sometimes use dozens of software and digital security experts who plan a major attack, divide the work and — when the attack is successful — get paid in accordance with the value they had provided. There are people who scout targets for ransomware attacks. People who know what sort of companies are vulnerable, like Colonial which cannot afford to have its pipelines shut off for too long yet did not spend enough on cybersecurity to protect themselves from a coordinated attack. Other affiliates are recruited to publicise previous victims to pressure new victims into paying for the stolen data. It takes weeks, sometimes months, of meticulous planning to launch a successful attack.

The proceeds from ransomware are shared between attack administrators like Darkside and their partners, or affiliates, who provide access to organizations and deploy the ransomware. RaaS administrators can take up to 25% of the ransom for attacks that generate less than US$500,000. The figures decrease to 10% for ransoms greater than US$5 million.

The attackers or administrators or the core gang use affiliates to rent the use of ransomware strains like Cobalt Strike from their creators on the dark web. Before a big attack such as Colonial Pipeline, the organisers, like Darkside which is overseeing the operations, place ads across the dark web asking for help in an upcoming operation. The creators of ransomware and other services get a cut of the ransom from each successful attack from Darkside for the tools or services they provide.

It is not just ransomware that a gang like Darkside or REvil is renting in the process of carrying out a successful attack. Successful execution requires coordination and teamwork. Darkside might need illicit cloud services to store stolen data from Colonial. It can’t just approach Amazon.com’s outgoing CEO and say, “Hey, Jeff Bezos, can you spare space on AWS?” It may need payment software and digital wallets. It can’t just call up Jack Dorsey, former CEO of payments giant Square and ask for his help. It may need a whole suite of money laundering services as well as a bunch of hackers who actually carry the attack. These services cost money and require teams that execute to perfection in a timely manner.

Think of the Ransomware administrator like Darkside or Ragnar Locker the way you might think of a contractor who supervises the construction of a building. He has to hire plumbers, electricians, wall painters and indeed oversee an entire supply chain making sure steel, cement, paints as well as all the necessary fixtures and fittings get to the site on time and the whole system operates like clockwork. The contractor often collects the biggest chunk of the money but he can’t do it all himself. He relies on others who have to be paid their fair share so he can keep constructing other buildings and keep making money. Darksides of the world are just ransomware administrators or a contractor at the apex of a complex ecosystem of bad actors helping in a great heist.

And teams are not just located in basements around suburban Moscow. They have huge support infrastructure around the world — Europe, Asia, America and Africa to whom they outsource key parts of the work. But as often in organised crime, most people in the ecosystem do not know the whole details of the attack plan. They just know the role they are supposed to play and get paid for doing their part. It may have begun with an individual rogue hacker or a gang of mates in some basement in Moscow or Shanghai or Tehran, but the ransomware industry is now a well-heeled machine in which everyone knows their role.

How was the Darkside gang caught by the FBI? What does it all mean for future ransomware attacks? Will the hackers now abandon bitcoin and other crypto currencies that leave footprints on the blockchain or will they merely be more careful? In the aftermath of the FBI's raid of Darkside’s wallet to recover the ransom, new attacks have continued unabated. After all, the use of marked currency notes to pay ransom in kidnappings around the world hasn’t ended crimes like that. Where there is money, thieves just keep finding new ways to steal it.

After every reported ransomware attack law enforcement agencies try to learn about how the hackers operate — how they attack the website, what they steal, how they blackmail companies and force them into paying ransom, how they collect ransom in cryptocurrencies and how the proceeds are distributed across the vast ransomware supply chain. Cryptocurrencies have allowed governments to dig deeper into where the ransom money goes and enable enforcement agencies to understand who does the real gruntwork behind the ransomware attack and how much that work is worth to the ransomware administrators like Darkside.

While cryptocurrencies like Bitcoin have long been used in money laundering as well as other crimes like ransomware or by rogue states to fund espionage, terrorism or get paid for their nefarious activities, only in the past year or so, the scale of crypto transactions have become so huge that law enforcement agencies around the world have actively begun to use and harvest the blockchain to scour such transactions, track down culprits and indeed disrupt those business. Even before the advent of cryptocurrencies, it was not unheard of for thieves to get caught and for their loot, or part of it, recovered.

In the aftermath of the Colonial attack, the White House described ransomware as a major national security threat and even compared it to the 9/11 terrorist attack 20 years ago. If you speak to cybersecurity experts and consultants (and I have spoken to several of them in recent weeks), they will tell you that while there are very real threats to business and security from state actors — Russia, China, Iran and North Korea etc — the key threat is cybercriminals, some of whom may be known to their home governments even if all their work is not expressly being condoned by the leaders.

The big ransomware groups based in Russia are tolerated as long as they don’t threaten the interests of President Vladimir Putin’s Administration. If they disrupt infrastructure in North America or Europe they are just serving the interests of the Russian state. The solution might be to force Russia to own the growing ransomware problem. For their part, governments around the world should discourage the payment of ransoms, make it compulsory for such payments to be disclosed. So far, insurance companies have been happy to pay out ransom demands as long as premiums from new policies continue to grow. Insurers must discourage clients from promptly paying up ransom and moving on because that only encourages Darksides of the world to get ready for the next attack.

Ransomware is a serious global problem, far more serious than Somali pirates attacking cargo ships in Indian Ocean a decade ago. But it can be tackled. We just need different kinds of tools and skills to tackle cyber crimes. We need more effective monitoring of data, better anti-hacking software, better trained IT staffers with more sophisticated tools to disrupt the business model of ransomware gangs and the ever growing pool of enablers, affiliates and partners who help the likes of REvil or Darkside carry out the attacks and cripple key infrastructure.

On Friday, May 7, Colonial Pipeline, which accounts for more than half of all petrol and diesel supplies across the US East Coast, including New York, Boston and Miami, was targeted by Darkside, a Russian ransomware gang. Cyber criminals stole sensitive data which forced Colonial to shut its pipelines down, causing a spike in prices at the pump and long queues of cars and trucks trying to fill up their tanks. Darkside demanded US$4.4 million ($5.9 million) worth of Bitcoin as ransom. As any key infrastructure firm would have done, the pipeline operator promptly deposited Bitcoin in Darkside’s digital wallet and got its data back.

Four weeks later, the US Department of Justice announced that it had recovered most of the bitcoin that had been paid by Colonial to Darkside. The FBI has not disclosed exactly how it extracted the ransom from the extortionist gang’s digital wallet. But here is what we do know: All bitcoin transactions, even ransoms paid to hackers, are duly recorded on the blockchains that store data in blocks that are then chained together. Put simply, blockchains provide digital footprints that can be traced back to people or parties on both sides of a cryptocurrency transaction.

Colonial was not alone. Among recent ransomware attacks, the world’s largest meatpacker JBS, the Irish national health service, and the ferry service to Martha’s Vineyard and Nantucket in Massachusetts have one thing in common with Colonial. They are all key cogs of critical infrastructure and are targeted because they are more likely to pay promptly. The biggest ransom ever paid was by US travel management company CWT Global, which handed over US$4.5 million in bitcoin to the Ragnar Locker gang in July 2020. Attackers like Darkside, Avaddon, Netwalker and REvil are increasingly using sophisticated ransomware techniques to shake down unwary and unprepared businesses, public institutions and government agencies.

Most attacks start by installing Cobalt Strike beacons in the computers of their targets to proactively test their defenses against advanced tactics and procedures. The beacons give attackers like Darkside access to the network. Once they have gained a foothold inside the IT network of the firm, they can easily steal data and deploy their ransomware.

As of mid-June, there had been over 90 reported ransom attacks this year alone. That is a 60% surge over the past 12 months. Most ransomware attacks go unreported because companies, particularly publicly listed ones, do not want investors to know that they are paying ransom. While most news reports focus on million-dollar ransoms being paid to big companies, small- to mid-sized businesses are at the largest risk, with ransom demands regularly hitting six or seven figures. By the way, the average ransom payment doubled over the past year, according to Coveware, a Connecticut-based cybersecurity consultancy. About 56% of ransomware victims paid a ransom last year, according to global security company Kaspersky. Most of the big firms, or those in sensitive sectors like infrastructure, pay up immediately.

The business of ransomware is more than just a bunch of hackers in some Moscow basement coding software that allows them to hack a website in Texas or or London or Tokyo, extracting info and then divvying up the money among themselves. It is a far more complex undertaking. It requires detailed planning, teamwork and precision execution. Ransomware gangs sometimes use dozens of software and digital security experts who plan a major attack, divide the work and — when the attack is successful — get paid in accordance with the value they had provided. There are people who scout targets for ransomware attacks. People who know what sort of companies are vulnerable, like Colonial which cannot afford to have its pipelines shut off for too long yet did not spend enough on cybersecurity to protect themselves from a coordinated attack. Other affiliates are recruited to publicise previous victims to pressure new victims into paying for the stolen data. It takes weeks, sometimes months, of meticulous planning to launch a successful attack.

The proceeds from ransomware are shared between attack administrators like Darkside and their partners, or affiliates, who provide access to organizations and deploy the ransomware. RaaS administrators can take up to 25% of the ransom for attacks that generate less than US$500,000. The figures decrease to 10% for ransoms greater than US$5 million.

The attackers or administrators or the core gang use affiliates to rent the use of ransomware strains like Cobalt Strike from their creators on the dark web. Before a big attack such as Colonial Pipeline, the organisers, like Darkside which is overseeing the operations, place ads across the dark web asking for help in an upcoming operation. The creators of ransomware and other services get a cut of the ransom from each successful attack from Darkside for the tools or services they provide.

It is not just ransomware that a gang like Darkside or REvil is renting in the process of carrying out a successful attack. Successful execution requires coordination and teamwork. Darkside might need illicit cloud services to store stolen data from Colonial. It can’t just approach Amazon.com’s outgoing CEO and say, “Hey, Jeff Bezos, can you spare space on AWS?” It may need payment software and digital wallets. It can’t just call up Jack Dorsey, former CEO of payments giant Square and ask for his help. It may need a whole suite of money laundering services as well as a bunch of hackers who actually carry the attack. These services cost money and require teams that execute to perfection in a timely manner.

Think of the Ransomware administrator like Darkside or Ragnar Locker the way you might think of a contractor who supervises the construction of a building. He has to hire plumbers, electricians, wall painters and indeed oversee an entire supply chain making sure steel, cement, paints as well as all the necessary fixtures and fittings get to the site on time and the whole system operates like clockwork. The contractor often collects the biggest chunk of the money but he can’t do it all himself. He relies on others who have to be paid their fair share so he can keep constructing other buildings and keep making money. Darksides of the world are just ransomware administrators or a contractor at the apex of a complex ecosystem of bad actors helping in a great heist.

And teams are not just located in basements around suburban Moscow. They have huge support infrastructure around the world — Europe, Asia, America and Africa to whom they outsource key parts of the work. But as often in organised crime, most people in the ecosystem do not know the whole details of the attack plan. They just know the role they are supposed to play and get paid for doing their part. It may have begun with an individual rogue hacker or a gang of mates in some basement in Moscow or Shanghai or Tehran, but the ransomware industry is now a well-heeled machine in which everyone knows their role.

How was the Darkside gang caught by the FBI? What does it all mean for future ransomware attacks? Will the hackers now abandon bitcoin and other crypto currencies that leave footprints on the blockchain or will they merely be more careful? In the aftermath of the FBI's raid of Darkside’s wallet to recover the ransom, new attacks have continued unabated. After all, the use of marked currency notes to pay ransom in kidnappings around the world hasn’t ended crimes like that. Where there is money, thieves just keep finding new ways to steal it.

After every reported ransomware attack law enforcement agencies try to learn about how the hackers operate — how they attack the website, what they steal, how they blackmail companies and force them into paying ransom, how they collect ransom in cryptocurrencies and how the proceeds are distributed across the vast ransomware supply chain. Cryptocurrencies have allowed governments to dig deeper into where the ransom money goes and enable enforcement agencies to understand who does the real gruntwork behind the ransomware attack and how much that work is worth to the ransomware administrators like Darkside.

While cryptocurrencies like Bitcoin have long been used in money laundering as well as other crimes like ransomware or by rogue states to fund espionage, terrorism or get paid for their nefarious activities, only in the past year or so, the scale of crypto transactions have become so huge that law enforcement agencies around the world have actively begun to use and harvest the blockchain to scour such transactions, track down culprits and indeed disrupt those business. Even before the advent of cryptocurrencies, it was not unheard of for thieves to get caught and for their loot, or part of it, recovered.

In the aftermath of the Colonial attack, the White House described ransomware as a major national security threat and even compared it to the 9/11 terrorist attack 20 years ago. If you speak to cybersecurity experts and consultants (and I have spoken to several of them in recent weeks), they will tell you that while there are very real threats to business and security from state actors — Russia, China, Iran and North Korea etc — the key threat is cybercriminals, some of whom may be known to their home governments even if all their work is not expressly being condoned by the leaders.

The big ransomware groups based in Russia are tolerated as long as they don’t threaten the interests of President Vladimir Putin’s Administration. If they disrupt infrastructure in North America or Europe they are just serving the interests of the Russian state. The solution might be to force Russia to own the growing ransomware problem. For their part, governments around the world should discourage the payment of ransoms, make it compulsory for such payments to be disclosed. So far, insurance companies have been happy to pay out ransom demands as long as premiums from new policies continue to grow. Insurers must discourage clients from promptly paying up ransom and moving on because that only encourages Darksides of the world to get ready for the next attack.

Ransomware is a serious global problem, far more serious than Somali pirates attacking cargo ships in Indian Ocean a decade ago. But it can be tackled. We just need different kinds of tools and skills to tackle cyber crimes. We need more effective monitoring of data, better anti-hacking software, better trained IT staffers with more sophisticated tools to disrupt the business model of ransomware gangs and the ever growing pool of enablers, affiliates and partners who help the likes of REvil or Darkside carry out the attacks and cripple key infrastructure.

Assif Shameen is a technology and business writer based in North America.