A Major Ransomware Takedown Suffers a Strange Setback

While Tuesday morning’s law enforcement action was meant to deal a critical blow to the gang, it did not come with sanctions or indictments, and ultimately seemed to simply cap more than a year of pervasive and deeply consequential attacks. The fact that the gang briefly seemed to “unseize” the site on Tuesday afternoon only added to a sense of complexity about dealing with such cybercriminal actors, especially those who, like those behind Alphv, appear to be based in the relative safe haven of Russia.

“Law enforcement is moving a lot faster, but it is still not fast enough,” says Allan Liska, an analyst for the security firm Recorded Future who specializes in ransomware. “It takes a while to build a case, and in the meantime these groups wreak havoc.”

Part of the reason for law enforcement’s delay in attempting to take down Alphv’s infrastructure may have been an ongoing investigation into the actors behind the group. Alphv/BlackCat seems to have evolved from a gang known as BlackMatter, which, in turn, seemed to emerge as a recombination of the notorious Darkside ransomware group that targeted Colonial Pipeline in the US.

“This isn’t their first shit show. Unfortunately, it probably won’t be their last either,” says Brett Callow, a threat analyst at antivirus company Emsisoft. “But Alphv’s partners in crime will be wondering, what information law enforcement was able to collect? And who does it implicate?”

The takedown effort involved collaboration and parallel investigations from multiple law enforcement agencies, including those in the United Kingdom, Australia, Germany, Spain, and Denmark. The US Justice Department said Tuesday that a decryptor tool for the Alphv ransomware that was developed by the FBI has already helped more than 500 victims recover from attacks and avoid paying roughly $68 million in ransoms.

As ransomware groups rely more on a hybrid model, in which much of their leverage for extortion comes from the threat that they will leak data stolen from victims, decryptors are only one of many tools needed to help victims avoid paying ransoms. But Alphv’s attempt on Tuesday afternoon to let its customers use its ransomware for attacks on vital services like hospitals and nuclear plants made the existence of the decryptor more significant, given how dangerous and disruptive that activity might be.