Elliptic, a London-based startup that provides forensic analysis on the blockchain to identify illicit activity and money laundering, said it has discovered that the hackers behind the DDoS attack against the pipeline are likely based in Iran or Iraq.
The Eastern European criminal group DarkSide is linked to the ransomware attack that compromised the computer system of Colonial Pipeline, causing several days of outage, fuel shortage, and gas price hikes.
From the security point of view, the gas pipeline computer system is not very secure. People who wanted to prove that systems connected to the Internet are vulnerable organized a denial of service attack on a pipeline computer system using Internet connections. This caused criminal activities in many places, such as leaking personal information of several million people who are registered with medical insurance plans, disclosing users names and e-mail addresses, and many more negative effects.
Being the largest operator of pipelines in the US, it was a great relief to hear that a huge gas shortage to the East coast because of hackers has been resolved. For this job Elbit Systems CybeRU has helped identify and blocking Cyber threat and enabling normal supply flow of fuel.
Elliptic says that DarkSide received 75 BTC from Colonial Pipeline on May 8th. According to reports, the states of Alabama, Tennessee and Georgia suffered gas shortages due to pipeline acts of vandalism (it is thought). The firm added that it’s possible further information can be gleaned by investigating other wallets which contained 5 BTC or less originating from payments made during that time.
“The affiliate’s share (the part of the ransom that goes to the deployer of the malware) of both the Colonial Pipeline and Brenntag ransom payments were sent to the same Bitcoin address, suggesting that the same party was responsible for infecting both of these businesses.”
When the US government seized the Bitcoins, these Bitcoins were not in DarkSide wallet. Since then, DarkSide has been constantly moving their coins from one address to another making it virtually impossible for the law enforcement agencies to track down the wallets. The FBI is investigating this case and is working hard to find out how hackers moved $3 million worth of Bitcoin despite them seizing $5 million worth of them.
