DarkSide hackers have raked in more than $90 million in Bitcoin

The hacking group responsible for the Colonial Pipeline hack has made roughly $1.9 million per victim

The DarkSide ransomware group, which is thought to be behind the attacks on the Colonial pipeline, has made around $90 million in Bitcoin from 47 victims.

According to cyber  security firm Elliptic's co-founder and chief scientist Tom Robinson, victims made just over $90 million in Bitcoin ransom payments to DarkSide, originating from 47 distinct wallets. According to DarkTracer, DarkSide ransomware has infected 99 organizations, which suggests that around 47% of victims paid a ransom, and the average payment was $1.9 million.

“To our knowledge, this analysis includes all payments made to DarkSide, however further transactions may yet be uncovered, and the figures here should be considered a low bound,” said Robinson.

Cyber criminal gangs such as DarkSide have established a ransomware-as-a-service business model where they develop the malware but allow other hackers to breach victims. DarkSide then splits the proceeds between themselves and their affiliates.

In DarkSide’s case, the developer reportedly takes 25% for ransoms less than $500,000, but this decreases to 10% for ransoms greater than $5 million.

Blockchain analysis makes money split clear, with the different shares going to separate Bitcoin wallets controlled by the affiliate and developer.

Related Resource

Defend your organisation from evolving ransomware attacks

Learn what it takes to reduce risk and strengthen operational resiliency

Defend your organisation from evolving ransomware attacks - whitepaper from VeritasDownload now

Robinson said the DarkSide developer has received Bitcoins worth $15.5 million (17%), with the remaining $74.7 million (83%) going to the various affiliates.

Further analysis allowed the firm to see where the cryptocurrency was being spent or exchanged. Most of the funds were sent to cryptoasset exchanges, where they can swap them for other cryptoassets, or fiat currency, said Robinson.

Robinson said that most cryptoasset exchanges comply with anti-money laundering (AML) regulations, verifying customers’ identity, and reporting suspicious activity, such as ransomware proceeds.

“However, some jurisdictions do not enforce these regulations, and it is to exchanges in these locations that much of the DarkSide ransomware proceeds are being sent,” said Robinson.

The DarkSide ransomware group, believed to be based in Eastern Europe or Russia, has recently disbanded after further investigations by US law enforcement. An email to DarkSide’s affiliates said that it was shutting up shop “due to the pressure of the US.”

However, many criminal gangs have been said they are disbanding only to show up again weeks or months later under a new name.

Featured Resources

Defeating ransomware with unified security from WatchGuard

How SMBs can defend against the onslaught of ransomware attacks

Free download

The IT expert’s guide to AI and content management

How artificial intelligence and machine learning could be critical to your business

Free download

The path to CX excellence

Four stages to thrive in the experience economy

Free download

Becoming an experience-based business

Your blueprint for a strong digital foundation

Free download

Recommended

Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

17 Sep 2021
How do hackers choose their targets?
hacking

How do hackers choose their targets?

17 Sep 2021
Owner of DDoS for hire sites found guilty of hacking offences
distributed denial of service (DDOS)

Owner of DDoS for hire sites found guilty of hacking offences

17 Sep 2021
One-in-seven Nasdaq-100 companies ranked as highly susceptible to a ransomware attack
cyber crime

One-in-seven Nasdaq-100 companies ranked as highly susceptible to a ransomware attack

16 Sep 2021

Most Popular

Zoom: From pandemic upstart to hybrid work giant
video conferencing

Zoom: From pandemic upstart to hybrid work giant

14 Sep 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Google takes down map showing homes of 111,000 Guntrader customers
data breaches

Google takes down map showing homes of 111,000 Guntrader customers

2 Sep 2021