Mandiant Threat Intelligence, a subsidiary of FireEye, said DarkSide shared a statement Thursday with its criminal partners announcing that it would shut down. The message has been shared in multiple cyber crime circles, Mandiant said. Darksupp also claimed that cryptocurrency funds were withdrawn from the hacker group’s payment server, which hosted ransom payments made by victims such as Colonial Pipeline, the report said. The funds, which the group is typically supposed to split between itself and its partners, were transferred to an unknown wallet, Darksupp said, according to The Record. “This announcement stated that they lost access to their infrastructure, including their blog, payment, and CDN servers and would be closing their service,” Kimberly Goody, senior manager of financial crime analysis at Mbandiant, said in a statement. “The post cited law enforcement pressure and pressure from the United States for this decision.”
It remains unclear if the announcement is a ruse for the group to escape attention or avoid paying its partners. Cybersecurity analysts warned that anything posted by DarkSide operators should be taken with a grain of salt. The announcement was posted Thursday evening on cybercrime underground community Exploit Forum, according to Recorded Future threat intelligence analyst Dmitry Smilyanets.
The FBI confirmed that DarkSide was behind the $5 million ransomware attack on Colonial Pipeline.EPA/JUSTIN LANE “A few hours ago, we lost access to the public part of our infrastructure, namely: Blog. Payment server. DOS servers,” read a post online by user Darksupp, the operator of DarkSide, according to The Record.
“We have been in direct communication with Moscow about the imperative for responsible countries to take decisive action against these ransomware networks,” Biden said Thursday at a press conference. Motorists wait in line to fill their cars at a gas station in Alexandria, Virginia, following Colonial Pipeline’s shutdown.EPA/SHAWN THEW The cybergang’s claims come after President Biden said the US would go after the group.
“We have not independently validated these claims and there is some speculation by other actors that this could be an exit scam,” she added. Goody said that victims of the criminal group who have not paid ransom would be given decryptors to get their stolen data back, according to the messages shared on the cybercrime forums. President Joe Biden said that “we pursue a measure to disrupt” DarkSide’s ability to operate.NICHOLAS KAMM/AFP via Getty Images
The News Highlights
- Colonial Pipeline hackers, DarkSide, lost control of the ransom money
- Check the latest News news updates and information about business, finance and more.
For Latest News Follow us on Google News
- Show all
- Trending News
- Popular By week