The Justice Department said on Monday that it had recovered much of the ransom paid to hackers last month who shut down the computer systems of Colonial Pipeline, a critical pipeline operator.<\/p>\n
Colonial had paid a ransom worth roughly $4.4 million in Bitcoin to the Russian hacking group DarkSide after it used ransomware, a form of malicious software, to hold up the company\u2019s business networks in May. <\/span>That payment cleared the way for Colonial to resume pumping fuel through its pipeline, which stretches from Texas to New Jersey and accounts for nearly half of all transport fuels that flow up the East Coast. <\/p>\n The seizure on Monday marked a first-of-its-kind effort by a new Justice Department task force to hijack a cybercriminal group\u2019s profits through a hack of its Bitcoin wallet. The Justice Department said that it had seized 63.7 Bitcoins, currently valued at about $2.3 million. (The value of a Bitcoin has dropped over the past month.) <\/p>\n \u201cEarlier today, the Department of Justice has found and recaptured the majority of the ransom Colonial paid to the DarkSide network,\u201d the deputy attorney general, Lisa O. Monaco, said at a news conference Monday. <\/span><\/p>\n \u201cUsing technology to hold businesses, and even whole cities, hostage for profit is decidedly a 21st-century challenge, but the old adage, \u2018follow the money,\u2019 still applies,\u201d Ms. Monaco said. <\/p>\n Officials said that they identified a virtual currency account, often referred to as a \u201cwallet,\u201d that DarkSide had use to collect payment from one of its ransomware victims, and that a magistrate judge in the Northern District of California had granted a warrant to seize funds from the wallet earlier in the day. <\/p>\n The New York Times had earlier reported that Colonial Payment's ransom payout \u2014 as well as that of a German company, Brenntag \u2014 had been removed from DarkSide\u2019s Bitcoin wallet, though it was not clear who had orchestrated the move.<\/p>\n Colonial shut down its pipeline in response to the cyberattack, which included hackers threatening to release the company\u2019s data to the public, setting off panic buying and a fuel shortage that sent gas prices soaring and forced airlines to make extra fuel stops.<\/p>\n Weeks after DarkSide attacked Colonial, hackers associated with a Russian hacking group called Revil, used ransomware in an attempt to extort money from JBS, the world\u2019s largest meat processor. The attack forced JBS to shutter nine U.S. beef plants and disrupted poultry and pork plants. Cybersecurity researchers said that DarkSide is an offshoot of Revil.<\/p>\n The back-to-back attacks showed that hackers who once focused on stealing corporate secrets have begun to disrupt critical infrastructure. And the episodes raised questions about whether U.S. corporations could protect themselves against cyberthreats. <\/p>\n The White House held emergency meetings to address the attack, which led the Biden administration to make a series of announcements related to cyberattacks and ransomware.<\/p>\n