FBI vs. BlackCat

Ransomware attacks keep increasing. It is quite limited what local or international authorities can do against these attacks. The authorities intervene mostly after the ransomware attacks occurred and most of the time it is too late for after you got hit by a ransomware gang.

So be aware that it is YOU who can prevent ransomware attacks and it must be YOU who take actions against the ransomware gangs. DO take actions before you got hit. Allocate enough budget for cyber security before it's too late.

Well, it seems that cat-and-mouse-game between local or international authorities and ransomware gangs won't come to an end in the near future. (You guess who is the cat and who is the mouse in this game.)

Close to the end of the last year (2023), FBI seized the website of a ransomware gang, who are known as BlackCat or AlphV, and obtained some decryptor keys. The cat seems to have nine lives and the gang denied this partly and claimed that they are still -almost- fully operational though.

https://bit.ly/48Fq0av

"The FBI created a decryption tool for the ransomware used by the gang known as BlackCat and/or AlphV, as part of a wider disruption campaign against the extortionists.

The existence of the decryptor was revealed in a Tuesday announcement by the United States Department of Justice that reports the FBI has offered the tool to over 500 orgs and believes $68 million of ransom payments were avoided as a result."

"...The Feds said they were able to access 946 public-private key pairs for Tor-hidden sites the BlackCat gang used to communicate with victims and host its blog,..."

"In other words, it sounds as though the Feds were not only able to seize and shut down the ransomware-as-a-service crew's dark-web presence, agents also obtained enough internal info to provide decryption assistance to victims..."

"The FBI operation was carried out in partnership with the plod in the UK and Australia, and Europol. Their probe into AlphV is ongoing and authorities have advised a reward may be offered to those who offer further information about the crew."

"The gang, believed to be Russian, today boasted it had "unseized" its main dark-web site by pointing it at a web server the miscreants control, rather than an FBI one. The crew used its restored blog to name new alleged victims of its ransomware."

"The FBI's claim of offering a decryptor to more than 500 victims has also been watered down by the group. According to the criminals, the number sits more at the 400 mark while still leaving 3,000 without a decryptor key."