Analysis: the wallet used by DarkSide received a total of $17.5M in Bitcoin transactions since March, including a 75 BTC payment made by Colonial
Elliptic's Co-founder and Chief Scientist discusses cryptocurrency forensics, investigations, compliance, and sanctions.
Elliptic Blog Dr. Tom Robinson
Related Coverage
- DarkSide, Hacking Group Linked to Colonial Pipeline Attack, Says It Is Closing Down Wall Street Journal
- Pipeline attacker Darkside suddenly goes dark—here's what we know Ars Technica · Dan Goodin
- DarkSide Drama Isn't The Death Of Ransomware - It's Not Even The Death Of DarkSide Forbes · Davey Winder
- Colonial Pipeline Paid $5 Million to Ransomware Gang: Reports SecurityWeek · Eduard Kovacs
- DarkSide ransomware servers reportedly seized, operation shuts down BleepingComputer · Lawrence Abrams
- DarkSide ransomware crims quit as Colonial Pipeline attack backfires iTnews · Juha Saarinen
- DarkSide, Blamed for Gas Pipeline Attack, Says It Is Shutting Down New York Times · Michael Schwirtz
- Flush with bitcoin, hacker group behind Colonial Pipeline attack says it's done Mashable · Jack Morse
- Darkside Retreats to the Dark Zero Day · Kim Zetter
- Bitcoin Wallet Used by DarkSide for Ransom Payments ID'd by Elliptic CoinDesk · Kevin Reynolds
- Colonial Pipeline Pays 75 Bitcoin Ransom To Hackers Bitcoin Magazine · Namcios
- Colonial Pipeline joins Brenntag in paying millions of dollars worth of Bitcoin as ransom Neowin · Subir Kathuria
- DarkSide Ransomware Gang Quits After Servers, Bitcoin Stash Seized Krebs on Security · Brian Krebs
- The moral underground? Ransomware operators retreat after Colonial Pipeline hack Intel471.com
- Group behind Colonial Pipeline hack to shut down operations: report The Hill · Jordan Williams
- Remarks by President Biden on the Colonial Pipeline Incident The White House · Roosevelt Room
- Ransomware 2021: Critical Mid-year Update [REPORT PREVIEW] blog.chainalysis.com
- A second Russian-language hacking forum bans ransomware-related ads, and the first claim is filed against DarkSide DataBreaches.net
- DarkSide Ransomware Group Faces XSS Ban, Servers Seized Flashpoint · Nick Hayes
- DarkSide ransomware call it quits after Bitcoin, servers are seized HackRead · Habiba Rashid
- Ransomware ads now also banned on Exploit cybercrime forum BleepingComputer · Sergiu Gatlan
- Russian-language cybercriminal forum ‘XSS’ bans DarkSide and other ransomware groups ZDNet · Jonathan Greig
- DarkSide, We Hardly Knew Ya: Ransomware Gang Behind Pipeline Hack ‘Quits’ the Business Gizmodo · Lucas Ropek
- Report: DarkSide ransomware group says it will end operations SiliconANGLE · Maria Deutscher
- DarkSide group that attacked Colonial Pipeline drops from sight online Washington Post
- Who is DarkSide - The Group Behind the Colonial Pipeline Breach? Gemini Advisory · reGemini
- Russian cybercrime forum XSS claims to ban ransomware following Colonial Pipeline hack CyberScoop · Sean Lyngaas
- DarkSide Ransomware Group Loses Server Access After US Moves to Disrupt Operations PCMag · Michael Kan
- Toshiba business unit says it was hacked by DarkSide criminal group New York Post · Will Feuer
- Did the Government Take Down the DarkSide Ransomware Group? The Mac Observer · Andrew Orr
Discussion
-
@sethforprivacy
Seth Simmons
on x
The ransom payment for the DarkSide hack of the Colonial pipeline is already being traced and tracked: https://www.elliptic.co/...
-
@z3r0trust
@z3r0trust
on x
“The hosting support service doesn't provide any info except ‘at the request of law enforcement authorities.’ [Also], a couple of hours after the seizure, funds from the payment server (belonging to us & our clients) were withdrawn to an unknown account.” https://arstechnica.com/…
-
@nicoleperlroth
Nicole Perlroth
on x
Darkside's operators have received $17.5 million in Bitcoin payments since March per @elliptic Those funds appear to have been laundered through Hydra which converts the cryptocurrency into gift vouchers, prepaid debit cards etc. https://twitter.com/...
-
@tomrobin
Tom Robinson
on x
BREAKING: @elliptic has identified the Bitcoin wallet used by the DarkSide ransomware group to receive ransoms from Colonial Pipeline and other victims. Learn more, including where the bitcoins ended up.. https://www.elliptic.co/...
-
@joetidy
Joe Tidy
on x
Research from @elliptic into the payments made into DarkSide's Bitcoin wallets. $17m since March. Since. March. https://www.elliptic.co/... https://twitter.com/...
-
@jeffstone500
Jeff Stone
on x
hopefully this finally dispels the myth that bitcoin is untraceable and/or a reliable means of hiding your crimes https://twitter.com/...
-
@jehrenhofer
@jehrenhofer
on x
Featuring the “untraceable cryptocurrency” BTC https://www.elliptic.co/...
-
@kimzetter
Kim Zetter
on x
“Elliptic has identified the Bitcoin wallet used by the DarkSide... this wallet received the 75 BTC payment made by Colonial Pipeline on May 8, following the crippling cyberattack on its operations.” So CP paid ransom on Saturday (depending on which timezone this uses) https://tw…
-
@lawrenceabrams
Lawrence Abrams
on x
Sadly, DarkSide ransomware gang made a killing this week. https://www.bleepingcomputer.com/ ...
-
@dangoodin001
Dan Goodin
on x
@LawrenceAbrams reporting that DarkSide just got a $4.4 million payment from chemical distributor Brenntag. DarkSide initially demanded a $7.5m in Bitcoin, but after negotiations, the ransom demand was decreased to $4.4m, which was paid two days ago. https://www.bleepingcomputer.…
-
@snlyngaas
Sean Lyngaas
on x
Statement from Mandiant's @tiskimber on the underground forum chatter about DarkSide RaaS: “We have not independently validated these claims and there is some speculation by other actors that this could be an exit scam.” https://twitter.com/...
-
@eamonjavers
Eamon Javers
on x
President Biden promised a US response to DarkSide yesterday and right now something very bad appears to be happening to DarkSide, which hacked the Colonial Pipeline.
-
@gregotto
Greg Otto
on x
Colonial Pipeline fallout: DarkSide ransomware group ceases operations, other ransomware operators change rules, Russian hacker forum bans ransomware ads https://www.intel471.com/... Tip @Techmeme
-
@ahcastor
Amy Castor
on x
The DarkSide ransomware affiliate program responsible for the Colonial Pipeline outage is running for the hills. The crime gang is closing up shop after its servers were seized and someone drained the crypto from an account it uses to pay affiliates. https://krebsonsecurity.com/ …
-
@shanehuntley
Shane Huntley
on x
These ransomware groups were able to target hospitals during a pandemic with relative impunity but causing an increase in US gas prices resulted in swift counter action? https://krebsonsecurity.com/ ...
-
@justin_ling
Justin Ling
on x
Well this is certainly interesting (strong caveat: *if it's real*). What the hell happened? Hackers grew a conscience? Moscow clamped down? FBI identified the crew? https://krebsonsecurity.com/ ...
-
@harrymccracken
Harry McCracken
on x
Always sad to see bad things happen to such an ethical, thoughtful bunch of cybercriminals. https://krebsonsecurity.com/ ...
-
@octal
Ryan Lackey
on x
Is there a special term for exit scam where you blame LE/IC action before bouncing? https://krebsonsecurity.com/ ...
-
@hackingdave
Dave Kennedy
on x
Darksides infra and funds mysteriously frozen and offline 👀 Other Ransomware groups amending their rules of engagement to not include hospitals, charity, and critical infrastructure. The ransomware industry crapping their pants at the moment. https://www.bleepingcomputer.com/ ...…
-
@thegrugq
Thaddeus E. Grugq
on x
Oooo. Exit scam! That's even funnier... the affiliate who is gonna get all the heat is getting stiffed by the bosses. I hope this is true https://twitter.com/...
-
@juanandres_gs
J. A. Guerrero-Saade
on x
If I'm disappointed in anyone, it's American criminals. Where's the JohnSmith Ransomware gang? Why aren't you demanding a billion rubles from Rosneft? We have nothing to trade with here. #BringJobsBackToAmerica #MadeInTheUSA
-
@marypcbuk
Mary Branscombe
on x
I'm sure they'll just be back under other names and even though DarkSide says it's 'releasing decryption tools for all of the companies that have been ransomed but which haven't yet paid' remember that decryption doesn't always work but still good news https://twitter.com/...
-
@danprimack
Dan Primack
on x
“We're terribly sorry. We didn't realize that hacking into critical infrastructure systems and holding them for ransom would be frowned on. Totally our bad. It's kind of like telling a joke at a party and no one laughs. How embarrassing for us.” https://twitter.com/...
-
@ericgeller
Eric Geller
on x
This one finally flipped over the rock, and the cockroaches scattered. https://twitter.com/...
-
@briankrebs
@briankrebs
on x
Top comment on Hacker News discussion in re: apparent attacks against DarkSide ransomware gang: “So taking down hospitals and healthcare facilities was fair game. But messing with Big Oil was just a step too far.” https://news.ycombinator.com/ ...
-
@shanvav
Shannon Vavra
on x
NSA Dir. Nakasone, also the commander of Cyber Command, DOD's offensive cyber unit, declines to comment on any potential ongoing/current response to Colonial Pipeline. “I won't get into any of the operations...right now” in response to a question from Matt Gaetz...
-
@eamonjavers
Eamon Javers
on x
Also - bear in mind that DarkSide may very well want the world to *think* they have gone away, even as they scramble to reconstitute in another format.
-
@briankrebs
@briankrebs
on x
Feeling the heat, DarkSide ransomware group — the one responsible for attacking Colonial Pipeline — closes after its servers were seized and cryptocurrency holdings mysteriously disappeared. Closure comes as crime forums start banning ransomware threads https://krebsonsecurity.co…
-
@gregotto
Greg Otto
on x
After that, REvil AND Avaddon announced new “rules,” barring affiliates from targeting gov, healthcare, edu and charity organizations regardless of their country of operation. Affliates also now need pre-approval https://www.intel471.com/...
-
@gregotto
Greg Otto
on x
Then, the operator of REvil announced they would stop promoting their malware on the above forum. Operator also said REvil would continue operating on another well-known forum, but expected to be banned there too. https://www.intel471.com/...
-
@gregotto
Greg Otto
on x
After dumping the DC police data, Babuk claimed it handed over the ransomware's source code to “another team,” which would continue to develop it under a new brand. The group pledged to stay in business, urged others to go private https://www.intel471.com/...
-
@gregotto
Greg Otto
on x
DarkSide releases a msg saying they are done, adding that their infrastructure was seized — Victim blog, CDN, ransom collection site — and their crypto wallets were emptied. Also sent affiliates decryption tools to unlock any ongoing ransom incidents. https://www.intel471.com/...
-
@gregotto
Greg Otto
on x
NEW BLOG: There has been a big upheaval among ransomware operators in the past 24 hours. DarkSide has announced its shutting down operations, REvil and Avaddon announcced new “rules” and a big cybercrime forum has BANNED anything to do with ransomware. https://www.intel471.com/..…
-
@kendilaniannbc
Ken Dilanian
on x
If this was the US government, it raises the question of why it took so long and why it's not done more often. https://twitter.com/...
-
@gregotto
Greg Otto
on x
A CAVEAT: All of these are claims coming from the criminals. They are as trustworthy as the guy in the picture below. Actions will always speak louder than words. Ransomware isn't going anywhere and @Intel471Inc will continue to watch https://www.intel471.com/... https://twitter.…
-
@helenkennedy
Helen Kennedy
on x
Looks like the guys who took down the Colonial pipeline have been taken down. https://twitter.com/...
-
@gregotto
Greg Otto
on x
Shortly thereafter, the admin for a popular Russian-lang crime forum announced a ban of all ransomware-related activity. The forum now prohibits ransomware ads, sales, negotiation services and similar offers. Any current listings will be deleted. https://www.intel471.com/...
-
@zackwhittaker
Zack Whittaker
on x
“Intel 471 observed numerous ransomware operators & cybercrime forums either claim their infrastructure has been taken offline, amending their rules or they are abandoning ransomware altogether due to the large amount of negative attention directed their way over the past week.” …
-
@kimzetter
Kim Zetter
on x
Hmm: “Intel 471 has observed numerous ransomware operators & cybercrime forums either claim their infrastructure has been taken offline, amending their rules, or they are abandoning ransomware...due to the large amount of negative attention...the past wk” https://www.intel471.com…