(FBI)
The FBI has disrupted one of the most notorious ransomware gangs, ALPHV/Blackcat.
On Tuesday, federal investigators announced they had seized several websites belonging to ALPHV, including the site the group used to leak stolen information from victims. The ALPHV ransomware page has since been replaced with an FBI takedown notice.
Using a search warrant, the FBI "gained visibility into the Blackcat ransomware group’s computer network.” This allowed federal investigators to create a decryption tool capable of reversing the group’s ransomware infections. The FBI has already offered the tool to over 500 victims.
“In disrupting the BlackCat ransomware group, the Justice Department has once again hacked the hackers,” says US Deputy Attorney General Lisa Monaco. “With a decryption tool provided by the FBI to hundreds of ransomware victims worldwide, businesses and schools were able to reopen, and health care and emergency services were able to come back online.”
The FBI says ALPHV has emerged “as the second most prolific ransomware-as-a-service variant in the world based on the hundreds of millions of dollars in ransoms paid by victims.” The group has also targeted more than 1,000 victims, including companies such as Reddit, Western Digital, and MGM Resorts International.
Like other ransomware gangs, ALPHV sells access to their ransomware code to other cybercriminals known as affiliates, who then conduct the actual attacks. The gang also resorts to using a double extortion tactic, encrypting computers and stealing sensitive data, to pressure victims into paying the ransom.
The unsealed search warrant shows the FBI was able to learn more about ALPHV’s activities after communicating with a “Confidential Human Source,” who had responded to the gang’s advertisement looking for new affiliates. Through the source, federal investigators gained access to a “Black affiliate panel” site on the dark web, which helped them unravel the group’s network.
The warrant adds that the “FBI identified and collected 946 public/private key pairs for Tor sites that the Blackcat Ransomware Group used to host victim communication sites, leak sites, and affiliate panels.”
Although the FBI has dealt a blow to the cybergang, the US announced no arrests. That’s probably because security researchers believe many ALPHV members are based in Russia, a country that refuses to extradite criminal suspects to the US.
It also looks like the group is working to rebound from the disruption. Security research outfit VX underground reports, “ALPHV ransomware group administrative group has contacted us to inform us they have moved their servers and blogs.”