The U.S. Department of State is upping the ante in its fight against ransomware by offering a reward of up to $10 million for information that helps identify or track down leaders of the notorious DarkSide ransomware group.
The State Department said it’s also offering as much as $5 million for information that leads to the arrest or conviction of anyone ”conspiring to participate in or attempting to participate in a DarkSide variant ransomware incident.” This is likely a nod to the group’s affiliate program, in which members receive a custom variant of the DarkSide ransomware and receive a chunk of any ransom payment profits.
“In offering this reward, the United States demonstrates its commitment to protecting ransomware victims around the world from exploitation by cybercriminals,” the State Department said. “The United States looks to nations who harbor ransomware criminals that are willing to bring justice for those victim businesses and organizations affected by ransomware.”
The FBI’s wanted poster for the DarkSide ransomware group. (Image: FBI)
The State Department says it launched the bounty in the wake of DarkSide’s attack on Colonial Pipeline earlier this year, which led to the shut down of a 5,500-mile pipeline that carries 45% of the fuel used on the U.S. east coast.
The group went dark shortly after its servers were hacked, and later rebranded as BlackMatter, which went on to attack Japanese technology giant Olympus in September and “multiple” organizations deemed critical infrastructure, including two companies in the U.S. food and agriculture sector. BlackMatter said this week that it was also ceasing operations due to pressure from law enforcement agencies.
The $10 million reward is being offered under the Department of State’s Transnational Organized Crime Rewards Program (TOCRP), which it manages with federal law enforcement partners as part of the government’s effort to disrupt and dismantle international crime syndicates. The State Department noted that it had paid $135 million in rewards since it was created in 1986.
It’s the latest in a long line of efforts by the Biden administration to crack down on the growing ransomware threat. Most recently, the Treasury took steps to crack down on virtual currency exchanges by sanctioning Suex for its role in facilitating ransomware payments.
