Share this page!

Kim Zetter Profile picture
Twitter logo
14 May, 4 tweets, 1 min read
"Elliptic has identified the Bitcoin wallet used by the DarkSide... this wallet received the 75 BTC payment made by Colonial Pipeline on May 8, following the crippling cyberattack on its operations." So CP paid ransom on Saturday (depending on which timezone this uses)
The wallet has been active since 4th March 2021 and received 57 payments from 21 different wallets. Some of the payments directly match ransoms known to have been paid to DarkSide by victims, such as 78.29 BTC ($4.4 million) sent by chemical distribution company Brenntag May 11.
"It has been reported within the past hours that DarkSide itself has ceased operations and has had its funds seized - and indeed their wallet was emptied of the $5 million in Bitcoin it contained on Thursday afternoon."
"by tracing previous outflows from the wallet, we can gain insights into how DarkSide and its affiliates were laundering their previous proceeds. ...18% of the Bitcoin was sent to a small group of exchanges. This info will provide law enforcement with critical leads"

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Kim Zetter

Kim Zetter Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @KimZetter

Kim Zetter Profile picture
13 May
Colonial Pipeline paid $5 million ransom to Darkside hackers within hours after attack last week. Once paid, the hackers provided a decrypting tool to restore the company's disabled network. Tool was very slow to work though. bloomberg.com/news/articles/…
Story says Colonial restored netwrk from backups not decrypted systems, because decryption tool was too slow. Note tho, expert I spoke to yesterday says they never restore from ransomed machines because untrustworthy; they always use backup when available zetter.substack.com/p/anatomy-of-o…
Some might ask why, if Colonial paid Friday, it took so long to get pipeline running. As noted in story👇 restoration from backups can take 1-2 months. Expert told me companies often don't have plan for restoring backups, and takes time to coordinate. zetter.substack.com/p/anatomy-of-o…
Read 5 tweets
Kim Zetter Profile picture
10 May
How a little-known cybersecurity consulting firm is leading one of the most significant events related to the 2020 presidential election. Why significant? Because what happens in Maricopa won't stay in Maricopa. zetter.substack.com/p/what-happens…
"Logan used to work for Digital Software in its Bloomington, Indiana office and founded Cyber Ninjas there in 2013 before moving to Sarasota the following year ...He has eleven children and describes Cyber Ninjas as a Christian firm.
“As a Christian company, we also believe we have a responsibility to serve, as Christ served,” reads a company press release. “Helping the USCC is a great way to be a blessing to others, while helping combat evil hackers.”
Read 5 tweets
Kim Zetter Profile picture
10 May
Biden declares state of emergency over pipelines - the move allows oil suppliers to transport their fuel via roadways while Colonial pipelines are down. I spoke w/ someone who works for oil company about what Colonial has told them and what they're doing zetter.substack.com/p/biden-declar…
Source tells me Colonial said pipelines would “not be fixed in 1-2 days, but won’t take 6 weeks.” He’s not sure why Colonial gave such wide timeframe but said it’s “very concerning for our interests.” They're scrambling to find more storage and may have to reduce refinery output
Source also tells me one reason Colonial might have taken operational network down - aside from being cautious - is because they may not be able to invoice customers who receive fuel if their IT network is locked with ransomware, preventing them from being paid for fuel.
Read 7 tweets
Kim Zetter Profile picture
8 May
Ransomware infection at Colonial Pipeline only infected its IT network; but according to source I spoke to it had potential to spread to operational network and even to upstream oil suppliers whose control systems connect directly to Colonial's systems zetter.substack.com/p/ransomware-i…
Colonial’s IT network and process control network are connected to share info about how much fuel each supplier receives and bill them. A “flow computer” on the process network sends info thru a data gateway and firewall to the corporate network, creating potential pathway
Once on control network, hacker could install malware or manipulate data. But Colonial’s control systems also connect to control systems at tank farms that feed fuel to Colonial pipeline. An attacker can potentially pass thru Colonial’s systems to control systems of these farms.
Read 9 tweets
Kim Zetter Profile picture
7 May
The Trump Justice Department secretly obtained the phone records of WaPo reporters @nakashimae @gregpmiller and @adamentous and tried to obtain their email records over reporting they did in the early months of the Trump administration on Russia’s role in the 2016 election.
The records for their telephone numbers covered the period April 15, 2017 to July 31, 2017. This included work and home or cellphone numbers covering that three-and-a-half-month period. The Justice Department defended its decision...as an investigative step of last resort
During period for which phone records were obtained, the journos wrote story about classified US intel intercepts that indicated in 2016 Sen. Jeff Sessions had discussed Trump campaign w/ Sergey Kislyak, Russia ambassador to US. Sessions was attorney gen when article published
Read 5 tweets
Kim Zetter Profile picture
2 May
Lisa Sales had just started work for Booz Allen Hamilton, a Pentagon contractor, when she was raped by her house tenant - a Russian grad student. She soon learned he was the son of a former career officer in Russia's FSB, who had spied for the US for 6 yrs news.yahoo.com/how-a-brutal-a…
As she dug into her assailant's history, she learned the father/son had likely been relocated to the US by the CIA; records showed the father had $16 million in assets, presumably payment from CIA. After raping Sales, the son was arrested again for threatening a couple with a gun
This story raises a lot of questions about the CIA's spy relocation program and what happens when former spies or their families commit crimes here. News about the crimes can draw unwanted attention to the spy, which puts CIA in difficult situation. Do they try to cover up crime?
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @KimZetter has new unrolls!

Check out other threads from @KimZetter!

Read all threads by @KimZetter

:(