Hacker News Reader

Comment by jtchang | Hacker News Reader

Just like the mob there are some targets that just aren't worth it because they bring too much heat. They are learning this is bad for business all around so they are stepping back and encouraging others to do the same.

View on HN

One thing that impressed me about this situation was the speed at which this was dealt with. A few hours after the attack, an executive order was signed reducing regulations around truck transport of fuel. But the next day, service was being restored. And by the end of the week, the attackers were disbanded and their assets seized.

There's a pretty clear message here that the US isn't fucking around.

If I'd just collected enough ransom to retire and never work again, I'd also put out a press release announcing I was out of business and someone seized all my shit and etc.

Darkside was a legit business. They routinely collected ransoms ten or twenty times larger than what they got from Colonial. if they were going to retire, they would have done it a long time ago

I can't find evidence of this "routinely collected ransoms ten or twenty times larger than what they got from Colonial" claim. Colonial is rumored to have paid out ~$4mm. Every source about Darkside seems to cite a "between $200,000 and $2 million for the file decryption key" range. This would put the Colonial ransom far above their typical payout.

Didn't Colonial pay $5m? I don't think Darkside ever received a $50m-$100m ransom. Do you have any more details?

They don't have financial reports and insurance companies don't routinely disclose ransom amounts.

Darkside has opened negotiations in the tens of millions in the past [0], with an average demand in the millions [1]

[0] https://krebsonsecurity.com/2021/05/a-closer-look-at-the-dar...

[1] https://www.areteir.com/darkside-ransomware-caviar-taste-on-...

This is it. Governments have cyber abilities that far outstrip individual organizations. And when cyber fails, there are still other diplomatic and less diplomatic tools.

I wouldn't be surprised if the US Government here reached out to foreign governments for assistance in dismantling their infrastructure (it almost certainly was not on US soil).

An individual hospital probably couldn't garner that kind of backing, but oil pipelines? The US would probably be willing to use military strikes to keep the oil flowing. A small country would be very willing to help out to maintain good will.

Small countries routinely help out for cases like this. I expect the US has reached out to whatever ones were involved long ago - it is just that until now things were still in the evidence gathering stage. While the police are sometimes willing to make an example of the wrong guy - that is the exception - most of the time they try to be right which means long investigations over many attacks.

Exactly. Also not sure why everyone says Bitcoin is anonymous. It's as anonymous as how deep someone is willing to spend to uncover your address. If we are talking multiple nation states who are interested in tracking you down you are pretty much screwed.

The problem is the US doesn't have any jurisdiction over Russia, and the Russian government turns a blind eye to these activities (and sometimes works with certain cybercriminals) as long as Russian citizens aren't victimized. Not only will they not extradite, they won't do anything at all to address it. So another government would have to resort to extralegal methods like what ostensibly happened in this case, if it isn't a smokescreen. (I think either scenario is plausible.)

(This isn't some anti-Russian screed or anything; this is just one particular point where the Russian government is IMO behaving improperly. I could elaborate if needed.)

> Russian government turns a blind eye to these activities

Presumably in return for some sort of gratuity. Perhaps they decided they weren’t getting a big enough cut.

Reply on news.ycombinator.com