x

Politics

Pipeline Exec to Face Congress as US Recovers Most of Ransom

WASHINGTON — The chief executive of the massive fuel pipeline hit by ransomware last month is expected to detail his company's response to the cyberattack and to explain his decision to authorize a multimillion-dollar payment when he testifies before Congress this week.

Colonial Pipeline CEO Joseph Blount will face the Senate Homeland Security Committee on Tuesday, one day after the Justice Department revealed it had recovered the majority of the $4.4 million ransom payment the company made in hopes of getting its system back online. A second hearing is set for Wednesday before the House Homeland Security Committee.

Blount's testimony marks his first appearance before Congress since the May 7 ransomware attack that led Georgia-based Colonial Pipeline, which supplies roughly half the fuel consumed on the East Coast, to temporarily halt operations. The attack has been attributed to a Russia-based gang of cybercriminals using the DarkSide ransomware variant, one of more than 100 variants the FBI is currently investigating.

The company decided soon after the attack to pay ransom of 75 bitcoin, then valued at roughly $4.4 million. Though the FBI has historically discouraged ransomware payments for fear of encouraging cyberattacks, Colonial officials have said they saw the transaction as necessary to resume the vital fuel transport business as rapidly as possible.

The operation to seize cryptocurrency paid to the Russia-based hacker group is the first of its kind to be undertaken by a specialized ransomware task force created by the Biden administration Justice Department. It reflects a rare victory in the fight against ransomware as U.S. officials scramble to confront a rapidly accelerating threat targeting critical industries around the world.

"By going after the entire ecosystem that fuels ransomware and digital extortion attacks — including criminal proceeds in the form of digital currency — we will continue to use all of our resources to increase the cost and consequences of ransomware and other cyber-based attacks," Deputy Attorney General Lisa Monaco said at a news conference announcing the operation.

In a statement Monday, Blount said he was grateful for the FBI's efforts and said holding hackers accountable and disrupting their activities "is the best way to deter and defend against future attacks of this nature.

"The private sector also has an equally important role to play and we must continue to take cyber threats seriously and invest accordingly to harden our defenses," he added.

Cryptocurrency is favored by cybercriminals because it enables direct online payments regardless of geographical location, but in this case, the FBI was able to identify a virtual currency wallet used by the hackers and recovered the proceeds from there, Abbate said. The Justice Department did not provide details about how the FBI had obtained a "key" for the specific bitcoin address, but said law enforcement had been able to track multiple transfers of the cryptocurrency.

"For financially motivated cyber criminals, especially those presumably located overseas, cutting off access to revenue is one of the most impactful consequences we can impose," Abbate said. 

The Bitcoin amount seized — 63.7, currently valued at $2.3 million after the price of Bitcoin tumbled— amounted to 85% of the total ransom paid, which is the exact amount that the cryptocurrency-tracking firm Elliptic says it believes was the take of the affiliate who carried out the attack. The ransomware software provider, DarkSide, would have gotten the other 15%.

"The extortionists will never see this money," said Stephanie Hinds, the acting U.S. attorney for the Northern District of California, where a judge earlier Monday authorized the seizure warrant.

Ransomware attacks — in which hackers encrypt a victim organization's data and demand a hefty sum for returning the information — have flourished across the globe. Last year was the costliest on record for such attacks. Hackers have targeted vital industries, as well as hospitals and police departments.

Weeks after the Colonial Pipeline attack, a ransomware attack attributed to REvil, a Russian-speaking gang that has made some of the largest ransomware demands on record in recent months, disrupted production at Brazil's JBS SA, the world's largest meat processing company.

The ransomware business has evolved into a highly compartmentalized racket, with labor divided among the provider of the software that locks data, ransom negotiators, hackers who break into targeted networks, hackers skilled at moving undetected through those systems and exfiltrating sensitive data — and even call centers in India employed to threaten people whose data was stolen to pressure for extortion payments.

RELATED

NEW YORK — A jury of 12 people was seated Thursday in former President Donald Trump’s history-making hush money trial, propelling the proceedings closer to opening statements and the start of weeks of dramatic testimony.

Top Stories

Columnists

A pregnant woman was driving in the HOV lane near Dallas.

General News

NEW YORK – Meropi Kyriacou, the new Principal of The Cathedral School in Manhattan, was honored as The National Herald’s Educator of the Year.

Video

9 Are Facing Charges in What Police in Canada Say is the Biggest Gold Theft in the Country’s History

TORONTO (AP) — Police said nine people are facing charges in what authorities are calling the biggest gold theft in Canadian history from Toronto’s Pearson International airport a year ago.

Allman Brothers Band co-founder and legendary guitarist Dickey Betts dies at 80 Dickey Betts, who died Thursday at age 80, really was born a ramblin’ man.

NEW YORK  — New York police removed a pro-Palestinian protest encampment at Columbia University on Thursday and arrested more than 100 demonstrators, including the daughter of a prominent Minnesota congresswoman.

ATHENS - The special 'Easter Basket,' which offers traditional Easter foods at lower or unchanged prices, will come into effect from April 24 to May 4.

LIVERPOOL - Liverpool failed to overcome a three-goal deficit and was eliminated from the Europa League on Thursday despite beating Atalanta 1-0 in the second leg of their quarterfinal matchup.

Enter your email address to subscribe

Provide your email address to subscribe. For e.g. [email protected]

You may unsubscribe at any time using the link in our newsletter.