U.S. Offers $10 Million Reward for Information on DarkSide Ransomware Group

The U.S. government on Thursday announced a $10 million reward
for information that may lead to the identification or location of
key individuals who hold leadership positions in the DarkSide
ransomware group or any of its rebrands.

On top of that, the State Department is offering bounties of up
to $5 million for intel and tip-offs that could result in the
arrest and/or conviction in any country of individuals who are
conspiring or attempting to participate in intrusions affiliated
with the transnational organized crime syndicate.

“In offering this reward, the United States demonstrates its
commitment to protecting ransomware victims around the world from
exploitation by cyber criminals,” the State Department said^[1]
in a statement.

“The United States looks to nations who harbor ransomware
criminals that are willing to bring justice for those victim
businesses and organizations affected by ransomware.”

The development comes in response to DarkSide’s high-profile
attack on Colonial Pipeline^[2]
in May 2021, taking down the largest fuel pipeline in the U.S. and
disrupting fuel supply to the East Coast for roughly a week, after
the hackers managed to gain entry into the company’s networks using
a compromised virtual private network (VPN) account password that
was circulating in the dark web.

The ensuing heightened scrutiny in the wake of the attacks led
to the DarkSide group to shutter its operations^[3]
on May 17, citing a mysterious law enforcement seizure of its
online attack infrastructure. The cartel has since attempted to
resurrect itself in the form of BlackMatter^[4], only for it to close
shop a second time owing to pressure from local authorities and the
disappearance of a part of its members last month.

While it’s common for ransomware gangs to go underground,
regroup, and reincarnate, often under a new name, law enforcement
agencies in the U.S., Europe, and Asia have sought to put pressure^[5]
on the operators in various ways, forcing the cybercriminals to
cease operations over fears of being outed and arrested.