After nearly two weeks of speculation, the US Department of Justice has claimed credit for the takedown of ALPHV/BlackCat leak sites and infiltrating the ransomware group's network.
Experts speculate this could be a wrap for the ransomware group just in time for the holidays - sending its leadership into retirement and affiliates to try and find a new operator.
The FBI is also offering a free decryptor that it developed to help the more than 500 ALPHV/BlackCat victims it has identified to recover their systems.
According to the FBI warrant to search BlackCat property, unsealed today along with a DoJ announcement on the takedown, law enforcement was able to infiltrate the BlackCat operation with help from a confidential human source who applied with the group to become an affiliate.
The informant was granted credentials to the ransomware group's dashboard used to manage breaches, extortion demands, and payments, giving law enforcement a way into the operation, the warrant said.
It could be that the cops were working another angle.
Yelisey Bohuslavskiy, chief research officer with RedSense, was among the first to publicly confirm that the BlackCat system outages were the result of law enforcement efforts, back on Dec. 8.
There's also the goal of undermining profitability for cybercrime gangs.
McPherson added that law-enforcement organizations accept that it might not be realistic to expect a takedown to totally dismantle sophisticated cybercrime rings like BlackCat.
Successful disruption of a group like BlackCat also signals to both current and potential victims that when they are breached by ransomware, there are viable alternatives to paying the extortion, McPherson says.
BlackCat's Ransomware Future Bleak If history is any indicator, Bohuslavskiy is dubious the ALPHV/BlackCat operation will be able to recover from this takedown in any meaningful way.
Making it easier to retire than continue the ransomware operation is precisely what the FBI was hoping to accomplish with the BlackCat/ALPHV operation.
This Cyber News was published on www.darkreading.com. Publication date: Tue, 19 Dec 2023 23:50:24 +0000