Blogs
The latest cybersecurity trends, best practices, security vulnerabilities, and more
Ransomware Attacks and Ransom Payments Enabled by Cryptocurrency
By Bryan Palma · August 9, 2022
This summer I had the honor of providing a statement to the U.S. Senate Homeland Security & Governmental Affairs Committee during its hearing on the topic, “Rising Threats: Ransomware Attacks and Ransom Payments Enabled by Cryptocurrency.” Here are a few highlights on why this is a concern for me and Trellix given our work to help organizations detect, respond to remediate threats everyday.
Cryptocurrency: A dark veil
Cryptocurrency has become an almost universal form of payment in ransomware attacks. It helps criminals extort massive amounts of money from victims quickly. Because it is decentralized and distributed, malicious actors can easily hide transactions and make it difficult for authorities to track, confiscate their illicit gains and punish them with enforcement action.
In 2020, malicious actors extorted $692 million in cryptocurrency from ransomware attacks, up from $152 million in 2019, representing close to a 300% increase over a two-year period.
Following the money: The Sodinokibi case
Trellix Threat Labs continuously researchs threats using our sensors worldwide. Recently, we analyzed a ransomware-as-a-service known as Sodinokibi, or REvil. We discovered it involved generating a unique bitcoin (BTC) wallet for every single victim, as well as every Sodinokibi affiliate.
By linking underground forum posts with BTC transfer traces, we were able to uncover new information on the size of the campaign. We also uncovered what the affiliates do with their earnings following a successful attack. What did we learn from this analysis? Paying ransomware actors keeps the ransom model alive and drives other types of crime.
In 2021, Europol credited us with providing research which led to the arrest of five Sodinokibi’s affiliates and the identification of “master-wallets” also seized by authorities. The affiliates were digital thieves who demanded more than 200 million euros in ransom from their victims. With most of its infrastructure dismantled, the gang was nudged off the stage as a major player, though it continues its criminal activities at some level, even today. In my statement, I shared other groups we research including Lockbit, Cuba and Conti ransomware and Netwalker ransomware.
Action needed: Congress and the Executive Branch must explore these trends
The relationship of cryptocurrency to ransomware urgently needs further exploration. I urged our policy leaders to centralize reporting of ransomware attacks and their associated payments across federal agencies and adher to the recommendations in the recently released report by the Senate Homeland Security & Governmental Affairs Committee, entitled Use of Cryptocurrency in Ransomware Attacks, Available Data, and National Security Concerns.
If our elected leaders make this a priority, we can make an enormous difference in this area.
RECENT NEWS
-
Jun 27, 2024
Trellix Named an XDR Market Leader
-
Jun 11, 2024
Trellix Uncovers Spike in Cyber Activity from China and Russia
-
May 13, 2024
Seven Trellix Leaders Recognized on the 2024 CRN Women of the Channel List
-
May 6, 2024
Trellix Secures Digital Collaboration Across the Enterprise
-
May 6, 2024
Trellix Receives Six Awards for Industry Leadership in Threat Detection and Response
RECENT STORIES
Featured Content
Get the latest
We’re no strangers to cybersecurity. But we are a new company.
Stay up to date as we evolve.
Zero spam. Unsubscribe at any time.