https://www.reuters.com/technology/exclusive-us-give-ransomware-hacks-similar-priority-terrorism-official-says-2021-06-03/
Exclusive: U.S. to give ransomware hacks similar priority as terrorism
Christopher BingJune 3, 20217:50 PM EDT
The U.S. Department of Justice is elevating investigations of ransomware
attacks to a similar priority as terrorism in the wake of the Colonial
Pipeline hack and mounting damage caused by cyber criminals, a senior
department official told Reuters.
Internal guidance sent on Thursday to U.S. attorney's offices across the
country said information about ransomware investigations in the field
should be centrally coordinated with a recently created task force in
Washington.
"It's a specialized process to ensure we track all ransomware cases
regardless of where it may be referred in this country, so you can make
the connections between actors and work your way up to disrupt the whole
chain," said John Carlin, principle associate deputy attorney general at
the Justice Department.
Last month, a cyber criminal group that the U.S. authorities said
operates from Russia, penetrated the pipeline operator on the U.S. East
Coast, locking its systems and demanding a ransom. The hack caused a
shutdown lasting several days, led to a spike in gas prices, panic
buying and localized fuel shortages in the southeast.
Colonial Pipeline decided to pay the hackers who invaded their systems
nearly $5 million to regain access, the company said.
The DOJ guidance specifically refers to Colonial as an example of the
"growing threat that ransomware and digital extortion pose to the
nation."
"To ensure we can make necessary connections across national and global
cases and investigations, and to allow us to develop a comprehensive
picture of the national and economic security threats we face, we must
enhance and centralize our internal tracking," said the guidance seen by
Reuters and previously unreported.
The Justice Department's decision to push ransomware into this special
process illustrates how the issue is being prioritized, U.S. officials
said.
1/2
A person fills a fuel container at a Shell gas station, after a
cyberattack crippled the biggest fuel pipeline in the country, run by
Colonial Pipeline, in Washington, D.C., U.S., May 15, 2021.
REUTERS/Andrew Kelly/File Photo
"We've used this model around terrorism before but never with
ransomware," said Carlin. The process has typically been reserved for a
short list of topics, including national security cases, legal experts
said.
In practice, it means that investigators in U.S. attorney's offices
handling ransomware attacks will be expected to share both updated case
details and active technical information with leaders in Washington.
The guidance also asks the offices to look at and include other
investigations focused on the larger cybercrime ecosystem.
According to the guidance, the list of investigations that now require
central notification include cases involving: counter anti-virus
services, illicit online forums or marketplaces, cryptocurrency
exchanges, bulletproof hosting services, botnets and online money
laundering services.
Bulletproof hosting services refer to opaque internet infrastructure
registration services which help cyber criminals to anonymously conduct
intrusions.
A botnet is a group of compromised internet-connected devices that can
be manipulated to cause digital havoc. Hackers build, buy and rent out
botnets in order to conduct cyber crimes ranging from advertising fraud
to large cyberattacks.
"We really want to make sure prosecutors and criminal investigators
report and are tracking ... cryptocurrency exchanges, illicit online
forums or marketplaces where people are selling hacking tools, network
access credentials - going after the botnets that serve multiple
purposes," said Carlin.
Mark Califano, a former U.S. attorney and cybercrime expert, said the
“heightened reporting could allow DOJ to more effectively deploy
resources” and to “identify common exploits” used by
cybercriminals.
--
Iw mailing list
[email protected]
http://sticklist.org/mailman/listinfo/iw_sticklist.org
