Darkside ransomware gang says it lost control of its servers & money a day after Biden threat

[Mr. Sparkle]

Source: The Record

A day after US President Joe Biden said the US plans to disrupt the hackers behind the Colonial Pipeline cyberattack, the operator of the Darkside ransomware said the group lost control of its web servers and some of the funds it made from ransom payments.

“A few hours ago, we lost access to the public part of our infrastructure, namely: Blog. Payment server. CDN servers,” said Darksupp, the operator of the Darkside ransomware, in a post spotted by Recorded Future threat intelligence analyst Dmitry Smilyanets. “Now these servers are unavailable via SSH, and the hosting panels are blocked,” said the Darkside operator while also complaining that the web hosting provider refused to cooperate.

In addition, the Darkside operator also reported that cryptocurrency funds were also withdrawn from the gang’s payment server, which was hosting ransom payments made by victims. The funds, which the Darkside gang was supposed to split between itself and its affiliates (the threat actors who breach networks and deploy the ransomware), were transferred to an unknown wallet, Darksupp said.

This sudden development comes after US authorities announced their intention to go after the gang.

Read more: https://therecord.media/darkside-ransomware-gang-says-it-lost-control-of-its-servers-money-a-day-after-biden-threat/

[WA-03 Democrat]

1. How cute

Now that Putin’s puppy is out, crime is not paying that well.

The US is back on cyber offense. Stay frosty St. Petersburg!

[dweller]

2. Well played Mr President

Well played


✌🏻

[joetheman]

26. Joe just quietly and competently does his job.

The other guy would have been boasting all over himself.

Now to make these crimes major terrorists acts with sentences to match.

[hadEnuf]

56. The other guy would have been getting a cut of the ransom.

[Texin]

83. Exactly!

[DBoon]

84. The other guy fired anyone who could perform this counter-attack

[Budi]

3. Conveniently took the money & wiped the traceability.

Every thief since the beginning of thievery has an exit plan. How well that plan is executed at the vital moment is the trick.

Let's hope they skipped a step in their rush out the door.
Appears they met their match, with President Biden.

New Sherriff, as they say...😎

[WA-03 Democrat]

7. To shut down servers, their payment processing and their block chain keys

I would speculate they are so far in their system that Darkside has no control over their system. The tables were so quickly turned it smells like a trap to them too I bet. No one hacks better than the US.

[SWBTATTReg]

23. No one hacks better than the US. I am so glad to hear someone finally say something positive

about US capabilities on software, computer system hacking, etc. Generations of Americans have grown up teething on keyboards, monitors, computers, you name it. The capabilities of these generations of Americans is not fully recognized, as we constantly hear about the Russians, their allies in eastern European countries, etc. endlessly of their computer capabilities, to the point where I want to stick my finger in my throat and throw up.

Thank you.

It does show just how quickly Darkside was hacked (associated IP addresses were ID'ed, etc. and then hacked)...amazing.

[stopdiggin]

42. totally agree!

WE can do things too. In fact -- in most cases, we can do it better than you.

Messing with people needs to come with a price attached. And also totally agree with Biden's program to emphasis 'hardening' our targets -- both government and private. Way overdue.

[WA-03 Democrat]

58. Maybe one of these days

we will design our very own operating system and a web browser. Who knows, maybe a processor one of these days too. Oh shit, we have done design every fucking one from the desktop to the computer you carry in your hand. Maybe these Cisco guys can do a switch and router then we be banging. What or why does 100% of all internet traffic hits a US designed central exchange switch? Imagine a giant pool that you can never go through to the bottom or the side. You have to know what you want before they will dig.

The US backs up the entire internet all day in real-time. All these systems have a G mode.

[stopdiggin]

63. Problem is - yeah, US design and operation

but that doesn't mean US government control. (and I guess whether you see that as a 'problem' kind of depends on point of view). Or are you implying ("all these systems have G mode".) that the US government does have control of the entire infrastructure?

[Budi]

24. 😎

[GregariousGroundhog]

40. I doubt the US hacked them

The article specifically states that the hacker's former webhosting provider is refusing to cooperate with them. My guess is that the victim's and/or their internet service provider were able to provide the FBI with log information regarding what IP addresses the attack came from and that the webhosting provider which owns that IP address either voluntarily seized the hacker's data or did so after being presented with a search warrant by the FBI.

[stopdiggin]

44. maybe. but that doesn't explain the disappearing cryptocurrency

which suggests more penetration and access than just shutting down some servers. Or -- inside double cross. Somebody on the 'team' made off with the dough.

[WA-03 Democrat]

47. They have lost control of the operation (their servers)

They have lost control of their finances. They have lost control of their blog. That is a lot of things to go wrong the day after this was "resolved" and the President signed an emergency declaration of cyber security. What are the chances of anything happening after President Biden planning and executing on something? As Malcom Nance says that is a lot of coincidences to plan for. It is another wake up call that our utility IT systems need updating.

This is not a case of things running fine and dandy and the web-host in a neutral country.

[Sgent]

79. The FBI

can be part of a multi-pronged takedown by the CIA / NSA / CISA / USCC.

[Fortinbras Armstrong]

81. At a guess -- and I don't claim it's anything more -- I suspect that the webhost

Was threatened with criminal proceedings. No matter where it's based, accessory to grand larceny and extortion is not something one wants to be accused of. If the FBI says, "If you cooperate, we won't bring charges and we also won't release your name" most people would be anxious to help.

[GregariousGroundhog]

86. Internet service providers and webhosting providers generally are not liable for customer behavior

Feel free to google 'Section 230', but at a high level ISPs and webhosts are generally shielded from what their customers do online. The only exception I'm aware of are when a provider fails to act consistently on Digital Millennium Copyright Act (DMCA) notices.

[Fortinbras Armstrong]

89. Section 203 refers to speech hosted on systems owned by the provider.

Actual criminal activity is not protected. We have here grand theft and extortion.

[Ilsa]

68. This is such a relief to read after hearing

about zero day threats, Iranian hackers, etc.

I hope the story gets out for everyone to see that Biden has got this.

[SergeStorms]

69. I thought crypto-currencies were unhackable?

Or am I misunderstanding this? I have little knowledge of block chain currencies.

[WA-03 Democrat]

70. If you can see the data you can track and trace it

Yes, nothing is 100% safe. Here's a good read but yes it crypto currency is a multi-billion USD a year crime. [link: https://www.marketplacefairness.org/cryptocurrency/hacking-statistics/|

I have always been a bright yellow chicken of this market. I believe with President Biden, the mob is not going to be able to use these things to launder money.

[SergeStorms]

73. Thanks for the info.

I'll give it a read. I want to learn more about this area of finance, but I have to admit, sometimes they seem to be talking in a language I don't understand. I'm 72, and its getting more difficult to teach this old dog new tricks. Thanks again.

[alfredo]

78. Fuck with the bull, get the horn

[Probatim]

4. Really? The hackers got hacked in under 24 hours?

Will the nutters now complain Biden is going rogue? After placing blame for the hack squarely on his shoulders?

[BobTheSubgenius]

38. That's a dangerous path for them to tread.

On the one hand, they do get to complain about him going rogue. But that also acknowledges a great deal of competence, in planning, execution and stealth exit.

[Probatim]

41. It also makes me wonder if Biden waited to make his statement...

until after he knew the switch had been flipped.

One thing to make a threat and another to follow through on it.

[marble falls]

82. I thought Joe's no 'comment' and big fidget while saying it backs what you're saying ...

I think he was pre-empted with the question about Colonial paying $5M, he was waiting till the ducks fell to make an announcement.

[BobTheSubgenius]

85. You are definitely right about that!

And a belated welcome to DU!

[COL Mustard]

46. How Could This Even Possibly Be Biden's Fault?

It was a foreign sourced attack on a private US company. Nothing Biden could have done to prevent it...if the company had weak IT security, that's their issue, not the US Government's.

[Probatim]

55. Really? Rs have blamed Clinton, Obama, and Biden for everything under the sun.

Biden was already blamed for gas shortages caused by the hackers. Why is it his fault? RW Media/Rs set the tone and feed off of each other.

Now we'll hear how Biden is "setting a dangerous precedent by inserting the US Gov't in these operations".

It might not happen tonight but by Sunday, all the talking heads will be paraded out to tell us what a terrible idea this was

[NQAS]

5. Pretty nifty. . .

but this does sound like socialism.

Government stepping in to assist private company that failed to protect its systems.

Yes, this kind of cyber offense is a legitimate government concern, and I'm glad to see this result, but it is clearly government intervening in a private company's affairs (regardless of the importance of the company's in moving oil around the country).

Just sayin'.

[alittlelark]

12. I hope they give the bill to Colonial.

[SWBTATTReg]

28. If a criminal enterprise uses a common network to do its foul deeds, then the US is allowed to

intercede and interrupt the criminal endeavors...especially since more than likely, multiple companies are probably involved in the data network(s) being used (company A owns the originating piece, company B owns the transport piece, company C owns the terminating piece of the data call, etc.), so what company is the one that should act against the evil doers?

There are multiple laws governing efforts to secure the national data networks from harm, and probably far more laws/etc. now...this isn't socialism as you call it. It's effective policing and securing the vulnerable data networks from harm.

Federal Government Regulation There are three main federal cybersecurity regulations - - 1996 Health Insurance Portability and Accountability Act (HIPAA) - 1999 Gramm-Leach-Bliley Act - 2002 Homeland Security Act, which included the Federal Information Security Management Act (FISMA)
Read more at: https://www.appknox.com/blog/united-states-cyber-security-laws

[NQAS]

36. Interesting info

So would it depend on where along the system the hack occurred? If the failure that allowed the hack occurred within the Colonial system, then who's responsible for the failure to secure the network?

I don't have any heartburn with what seems to have been the USG response. I'd like to see more of that, even if we don't necessarily know that it's the USG doing it. As long as the hackers are disrupted.

I guess what bugs me is, somehow, the expectation that when there's a giant problem that the private sector either couldn't or wouldn't fix, the USG is where they turn. That being the case, I'd like to hear what the RWNJs have to say about this. (Actually, IDGAF about what the RWNJs have to say, but you get the idea.)

And it's not only the private sector. I read that the DC Police are currently the victim of a ransomware attack. Again, who's responsible? The network provider or the IT department? In this respect, I'm fine with infrastructure funding to address these issues for federal, state, and local agencies.

Turning to fiction, this was the subject of Lee Child's latest book, The Sentinel. Russian ransomware attack (with the usual Lee Child twists), but the failing was with the small town that refused to fund the work that would secure the town's network.

[stopdiggin]

52. I think the poster missed the slight sarcasm intended in your first message

Both of you obviously see a USG component in both defense and response measures. (I think -- certainly you do.) Defense of our infrastructure (and economy?) is -- well -- defense of the republic. Pretty much the same reason that we have the military.

I applaud Biden for bringing the focus of attention .... Security and tech people have been screaming for years. It's well overdue. Will we eventually be looking at "attractive nuisance" laws (or something similar) to force 'hardening' of both public and private sectors?

[Baked Potato]

35. Government and private systems are fully integrated.

All branches of government use equipment and systems ran by private companies. Clearly, private companies are not nearly powerful enough to carry out the maneuvers with the immediacy needed in these modern times.

Our system allows private companies full control until it threatens National Security.

[Bob_in_VA]

48. That's silly

What it sounds like happened is the cyber equivalent of a bank getting robbed and the FBI coming in to catch the robbers. Would that also be socialism?

[stopdiggin]

53. might have been a twinge of sarcasm involved? (nt)

[pandr32]

6. Good!

Biden Brigade is fully operational.

[jmbar2]

8. Bravo to the cyber wizards who pulled this off.

Makes me proud.

[MineralMan]

9. Sounds like the hackers got hacked by better hackers.

[Captain Zero]

16. Drain Putin's Accounts Next

Tell him to go get a real job !!

[asiliveandbreathe]

10. I certainly hope this story is true..for me..trust, but verify...hackers will hack..

like water..will always find a way...

[abqtommy]

11. Well, Darkside, now you know that what goes around on the internet comes around.

Welcome to the real world.

[IrishAfricanAmerican]

13. Joe Biden does it again!!

[progressoid]

14. OR...the hacker(s) took the money and ran, rather than split it with their friends.

[Pepsidog]

27. Good point, maybe a good exit strategy.

[dalton99a]

80. +1

[50 Shades Of Blue]

15. And they would announce this... why?

[Captain Zero]

17. In case any wannabees thinking about it?

Imho.

[ScratchCat]

22. I think he means the hackers

I guess

[50 Shades Of Blue]

32. That's a possibility! They must have *some* ulterior motive...

[TheFarseer]

66. To discourage other hackers nt

[irisblue]

18. honestly, the hackers are lucky to be alive and bitching

[ScratchCat]

20. This here

Few countries where they are unreachable(well, without starting something bigger).

[gordianot]

21. Considering this is Russia who poisons tea of political rivals.

I would not place bets they are still alive or they will be breathing in the near future.

[Grokenstein]

54. Well, the night is still young, so to speak.

[padah513]

19. Cue the Fox News outrage in five... four... three...

[Pepsidog]

25. Good. Just imagine this was a trial run to disrupt USA and make Biden look weak to the next would be

Dictator in waiting promising to protect us. Look how we acted, we are prime for other bad actors to disrupt our country setting up the next real American Dictator.

[ffr]

29. Notice to all Scum. There's a new Sheriff in town and he goes by the name of Joe!

[halfulglas]

30. Without more proof don't get too excited the US hacked them.

Since Darkside brags that they are "good" hackers and don't hack nonprofits, etc. They may have been hacked by thieves worse than them, not better.

[FakeNoose]

31. We need to do this with all the nasty operators - put them out of business

[SpankMe]

33. Proceed with caution

I'm surprised that a hacker organization would publicly admit it's been hacked. Criminal orgs don't usually issue press releases.

I suspect there's been some response by US cyber. But there is no way of knowing the truth a this stage in the game. The US doesn't want to divulge any strategic information on its cyber capabilities, and the hackers can't be trusted to tell the truth.

[The Unmitigated Gall]

34. Operating in Russia...

Stay in Russia, forever. Shitbirds.

[calimary]

87. Welcome to DU, The Unmitigated Gall!

Like your screen name!

And your message, also. Let's all think CONSEQUENCES. Literal AND - um - shall we say "creative"?

[The Unmitigated Gall]

88. Thank you! Love it here!

It’s embarrassing how long I’ve been following everyone here!

[quakerboy]

37. I do wonder

In that business its got to be a balancing act. Hack a school system or some fast food chain or a city, theres a remote chance you will face legal consequences. Generally speaking.

But I feel like in their shoes i'd be more careful in my targets. Touchy business going after a petrochemical company. Its my understanding those folks have a long history of not playing nice with their detractors in other countries. How much is a contract killing in Russia these days?

[Deep State Witch]

39. F*ck Around And Find Out

Suckas!

[Hekate]

43. Anyone else remember what Joe said when he and Pres Obama announced "Russian interference" ...

...in the 2016 election? That the US would respond “in a time and manner of our own choosing” ?

Clearly he had to wait longer than we ever anticipated, but he’s here now. Well done, Joe. Keep up the good work.

[Botany]

45. Hello computer science deptartments @ MIT and Cal Tech President Biden is on the line. Hold please.

BTW I think Joe knows that the Russian Govt. helped out in the hacking of the pipelines
computers but did not want to say so in public. Joe also knows that Russia hacked our
2016 elections and installed Trump and Sen. Johnson too.

[JustABozoOnThisBus]

49. I'm guessing if Darkside got hacked, it was Putin who did it.

Maybe Darkside wasn't kicking a respectful share up to the boss.

If the U.S. has that capability, why would we expose it for a "paltry" five million dollar payment? And, the pipeline company may have bought $5M in bitcoin, but it was only worth $3M by the time they could cash it in. Thanks to Jeff Bezos.

[HUAJIAO]

50. They must have hired Lisbeth Salander....

[Lovie777]

51. After getting 5M? . ..

that's all? .....................................................................

[inwiththenew]

57. I'm thinking one of the hackers ripped off the other hackers and this is the cover

Either that or it was designed to look they were hacked to throw off whoever is trying to track them down so that the money is never recovered.

Why else would a criminal organization put out a public statement that they lost money in an illegal act they just engaged in? This would be like the one of the drug cartel putting out a release saying they lost $5 million dollars they were laundering through one of their front companies.

[Aussie105]

59. Did the hackers get hacked?

If so, too bad, so sad!

But I bet there is more to this story.

[roamer65]

60. The NSA has all of the Windows back doors.

Easy as pie for them.

[msfiddlestix]

61. Interesting report.

I've been practicing all day, first moment checking in on "the news".. very very interesting report.

I've never come across The Record before now, and wonder if other news sites are carrying this story.. I'll check later. Just curious during a quick break.

[wryter2000]

62. Well done

Your government at work

[IronLionZion]

64. It could be a bluff

all the articles on this say US officials haven't confirmed what the hacker group has said.

[Karma13612]

65. If I understand correctly,

WELL DONE!!!

I am more and more worried about these cyberthreats and the consequences to water, power-grids, banking, ?stock market, healthcare institutions, etc.

This is good news!

[tanyev]

67. Awesome. Trump would have demanded a huge cut to give them access again.

[Hulk]

71. Wish they could crash this cryptocurrency scheme..

From what I have read, this is a Ponzi scheme that has extremely negative affect on the world financial system as well as clandestine activities.

I know fools who are buying this garbage up, hoping to make their fortune on this dark wealth scheme.

[Mysterian]

72. Now send a Hellfire missile up their ass, Mr. President!

These are enemies of the USA.

[jrandom421]

74. Hellfire missiles are too small They're 30 Kg and needs to be laser guided

Send them a GPS guided GBU-43 (MOAB), 8500 KG of "Knock Knock, Hackers"

[Turbineguy]

75. Well..... they did not get

chopped into little pieces by manchette wielding people seeking retribution....

[Pluvious]

76. Bitcoin Wallet Used by DarkSide for Ransom Payments ID'd by Elliptic

Bitcoin is very traceable...
I'm surprised the crooks didn't use one of the untraceable tokens.

The wallet used by the DarkSide ransomware group to receive bitcoin ransom payments has been identified, according to data analysis firm Elliptic, citing intelligence collection and analysis of blockchain transactions.

The wallet received the 75 BTC payment reportedly made by Colonial Pipeline on May 8, following the cyberattack that led to widespread fuel shortages in the U.S., Elliptic said in its report.

The wallet has been active since early March and has received 57 payments from 21 different wallets, including some matching ransoms known to have been paid to the group in other cases of blackmail, the firm said.
Since becoming active, the wallet has received bitcoin transactions totaling $17.5 million, Elliptic said.
Elliptic also said it has been able to gain intel on how DarkSide laundered prior attacks, potentially allowing authorities to locate the people behind them.

Earlier Friday, KrebsOnSecurity and others reported that the DarkSide group has decided to shut itself down after its own servers were seized and someone drained crypto from an account belonging to the group.

https://www.coindesk.com/bitcoin-wallet-used-by-darkside-for-ransom-payments-idd-by-elliptic

[rockfordfile]

77. One thing to do is boycott companies that are taking bitcoin as payments.

I think Newegg does?