Yesterday, the Department of Justice announced that it had seized roughly $2.3 million of the $4 million paid in ransom to the DarkSide ransomware gang by Colonial Pipeline following an attack against the latter’s networks. The seizure warrant was announced yesterday by Laurel Beeler, US Magistrate Judge for the Northern District of California. The funds would have been DarkSide’s profits for targeting Colonial Pipeline and taking its critical infrastructure out of operation. According to Deputy Attorney General Lisa Monaco, ransom payments are filing digital extortion campaigns, and the US has demonstrated that it is able to use available tools to make these types of attacks less lucrative and more dangerous for criminal enterprises.
The attack occurred on May 7, and after finding that it was unable to fully restore its systems, Colonial Pipeline paid the ransom request in exchange for a decryption key. The ransomware attack was highly publicized. Colonial Pipeline was in communication with several law enforcement agencies, including the FBI, to mitigate the risks of the attack. The company allegedly told the FBI that it had received and paid a ransom demand for 75 bitcoins. The FBI was then able to track several different transfers of Bitcoin to identify a specific address to which they were delivered.
