Saudi Press

Saudi Arabia and the world
Monday, Oct 06, 2025

Ransomware Attackers Up Ante as White House Vows Crack Down

Ransomware Attackers Up Ante as White House Vows Crack Down

A series of major cyber-attacks in recent weeks has underscored the brazenness of the attackers and the challenges of tackling the problem of ransomware, just as the Biden administration announced plans to take on the issue.

In a matter of days, attacks were revealed against the police department in Washington, D.C. , where the hackers threatened to release information about police informants to criminal gangs; the Illinois Attorney General’s office, which had been warned about weak cybersecurity practices in a recent state audit; and San Diego-based Scripps Health, where medical procedures were canceled and emergency patients diverted to other hospitals.

Then on Saturday, Colonial Pipeline confirmed that it had joined the list of recent ransomware victims in an attack that threatened to upend gasoline and diesel supplies on the East Coast. While few details about the attack are yet known, Colonial shut down the biggest gasoline pipeline in the U.S. as part of an effort to contain the threat.

“The recent ransomware attacks illustrate, by their number severity and range of targets, why we need to treat this problem on the level of a real national security threat both here and around the world,” said Christopher Painter, coordinator for cyber issues at the State Department under President Barack Obama. “Fortunately, people in our government are paying attention.”

The string of attacks came as the Biden administration has vowed to take on ransomware, which Department of Homeland Security Secretary Alejandro Mayorkas last week called “one of our most significant priorities right now.” His agency in March announced a 60-day sprint to address ransomware, and the Department of Justice has created its own ransomware task force.



Malicious Link

Ransomware is a type of malware -- often hidden in a phishing email or a malicious link -- that locks up a victim’s files, which the attackers promise to unlock for a ransom payment. More recently, ransomware groups have started stealing data and threatening to release it unless they are paid.

“It’s now a double-extortion scheme,” said Tyler Hudak, who handles incident response for the cybersecurity firm TrustedSec. “A lot of organizations will pay just to make sure their private data doesn’t get out.”

The scope of ransomware attacks is rapidly growing, with police departments, dental clinics, school districts and IT companies among the victims. Cybersecurity firm Emsisoft found that that almost 2,400 U.S. based governments, health-care facilities and schools were hit by ransomware in 2020.

A report released last month by a ransomware task force -- which included cybersecurity experts, government officials and academics -- said the amount paid by ransomware victims increased by 311% in 2020, reaching about $350 million in cryptocurrency. The average ransom paid by organizations in 2020 was $312,493, according to report.

So far, in addition to singling out ransomware, the Biden administration has also vowed to bolster defenses of critical infrastructure, including the electrical grid. The hackers behind the Colonial Pipeline attack took aim at both priorities, though it’s not clear if that was intentional.

While the investigation is still underway, a ransomware group called DarkSide appears to be behind the attack, according to Allan Liska, senior threat analyst at the cybersecurity firm Recorded Future.



Double Extortion

DarkSide first surfaced in August 2020 and uses the ransomware-as-a-service model, according to a blog post from the cybersecurity firm Cybereason. DarkSide uses the double extortion method in which it not only encrypts a victim’s data but exfiltrates it and threatens to make it public unless the ransom is paid, according to Cybereason.

“DarkSide is observed being used against targets in English-speaking countries and appears to avoid targets in countries associated with former Soviet Bloc Nations,” according to the blog.

While ransomware is primarily a profit-seeking venture perpetuated by criminals, there are allegations of foreign governments enabling or engaging in the attacks. Last year, the U.S. issued a warning about North Korea cyber crimes, including ransomware, saying the regime was increasing relying on illicit activity to generate money for weapons. In announcing sanctions against Russia in April, the Treasury Department stated that Russian intelligence cultivates and co-opts hackers “enabling them to engage in disruptive ransomware attacks and phishing campaigns.”

What to know in techGet insights from reporters around the world in the Fully Charged newsletter.
A major challenge in cracking down on ransomware is that many of the hackers operate out of countries that are unable or unwilling to prosecute them, making it difficult for authorities in the U.S. or elsewhere to bring them justice, according to the task force report. The hackers insist that ransom payments are made in cryptocurrency, making them difficult to track. It’s also relatively easy and cheap to launch ransomware, since some gangs now sell versions of the malware with instructions and customer service, a sort of criminal variation of the “software-as-a-service” model.

Another confounding issue is that many victims pay the ransom, something the FBI warns against because it encourages the attackers to target more victims and offers an incentive for others to get involved.

The task force report, prepared by the Institute for Security and Technology, includes 48 actions the Biden administration and the private sector could pursue for tackling ransomware, including using diplomacy and law enforcement to discourage foreign governments from providing a safe haven for ransomware gangs and imposing tougher regulation on cryptocurrency.

Painter, who was part of the task force, said it was a “timely call to action.” He added that “this problem will only get worse if we don’t address it now in a comprehensive way.”

Hudak said the success of ransomware gangs depends on establishing a reputation. That’s one reason many of them, including DarkSide, create pages on the dark web showing which companies they have attacked and files they’ve released from victims that don’t pay, he said.

“We’re working an incident right now where DarkSide is involved,” Hudak said. “They do research on their victims. They’ll know much money they make, whether they have cyber insurance and what that insurance will pay.”

Newsletter

Related Articles

Saudi Press
0:00
0:00
Close
Syria Holds First Elections Since Fall of Assad
Altman Says GPT-5 Already Outpaces Him, Warns AI Could Automate 40% of Work
Trump Organization Teams with Saudi Developer on $1 Billion Trump Plaza in Jeddah
Electronic Arts to Be Taken Private in Historic $55 Billion Buyout
Colombian President Petro Vows to Mobilize Volunteers for Gaza and Joins List of Fighters
Nvidia and Abu Dhabi’s TII Launch First AI-&-Robotics Lab in the Middle East
UK, Canada, and Australia Officially Recognise Palestine in Historic Shift
New Eye Drops Show Promise in Replacing Reading Glasses for Presbyopia
Dubai Property Boom Shows Strain as Flippers Get Buyer’s Remorse
Top AI Researchers Are Heading Back to China as U.S. Struggles to Keep Pace
JWST Data Brings TRAPPIST-1e Closer to Earth-Like Habitability
UAE-US Stargate Project Poised to Make Abu Dhabi a Global AI Powerhouse
Trump and Starmer Clash Over UK Recognition of Palestinian State Amid State Visit
Saudi Arabia cracks down on music ‘lounges’ after conservative backlash
Saudi Arabia Signs ‘Strategic Mutual Defence’ Pact with Pakistan, Marking First Arab State to Gain Indirect Access to Nuclear Strike Capabilities in the Region
Sam Altman sells the 'Wedding Estate' in Hawaii for 49 million dollars
Turkish car manufacturer Togg Enters German Market with 5-Star Electric Sedan and SUV to Challenge European EV Brands
World’s Longest Direct Flight China Eastern to Launch 29-Hour Shanghai–Buenos Aires Direct Flight via Auckland in December
New OpenAI Study Finds Majority of ChatGPT Use Is Personal, Not Professional
Kuwait opens bidding for construction of three cities to ease housing crunch.
This Week in AI: Meta’s Superintelligence Push, xAI’s Ten Billion-Dollar Raise, Genesis AI’s Robotics Ambitions, Microsoft Restructuring, Amazon’s Million-Robot Milestone, and Google’s AlphaGenome Update
Indian Student Engineers Propose “Project REBIRTH” to Protect Aircraft from Crashes Using AI, Airbags and Smart Materials
Could AI Nursing Robots Help Healthcare Staffing Shortages?
Turkish authorities seize leading broadcaster amid fraud and tax investigation
Qatari prime minister says Netanyahu ‘killed any hope’ for Israeli hostages
Apple Introduces Ultra-Thin iPhone Air, Enhanced 17 Series and New Health-Focused Wearables
Big Oil Slashes Jobs and Investments Amid Prolonged Low Crude Prices
Social Media Access Curtailed in Turkey After CHP Calls for Rallies Following Police Blockade of Istanbul Headquarters
Did the Houthis disrupt the internet in the Middle East? Submarine cables cut in the Red Sea
Gold Could Reach Nearly $5,000 if Fed Independence Is Undermined, Goldman Sachs Warns
Uruguay, Colombia and Paraguay Secure Places at 2026 World Cup
Trump Administration Advances Plans to Rebrand Pentagon as Department of War Instead of the Fake Term Department of Defense
Tether Expands into Gold Sector with Profit-Driven Diversification
Trump’s New War – and the ‘Drug Tyrant’ Fearing Invasion: ‘1,200 Missiles Aimed at Us’
At the Parade in China: Laser Weapons, 'Eagle Strike,' and a Missile Capable of 'Striking Anywhere in the World'
Information Warfare in the Age of AI: How Language Models Become Targets and Tools
Israeli Airstrike in Yemen Kills Houthi Prime Minister
After the Shock of Defeat, Iranians Yearn for Change
YouTube Altered Content by Artificial Intelligence – Without Permission
Iran Faces Escalating Water Crisis as Protests Spread
More Than Half a Million Evacuated as Typhoon Kajiki Heads for Vietnam
HSBC Switzerland Ends Relationships with Over 1,000 Clients from Saudi Arabia, Lebanon, Qatar, and Egypt
Sharia Law Made Legally Binding in Austria Despite Warnings Over 'Incompatible' Values
Dogfights in the Skies: Airbus on Track to Overtake Boeing and Claim Aviation Supremacy
Tim Cook Promises an AI Revolution at Apple: "One of the Most Significant Technologies of Our Generation"
Are AI Data Centres the Infrastructure of the Future or the Next Crisis?
Miles Worth Billions: How Airlines Generate Huge Profits
Zelenskyy Returns to White House Flanked by European Allies as Trump Pressures Land-Swap Deal with Putin
Beijing is moving into gold and other assets, diversifying away from the dollar
Cristiano Ronaldo Makes Surprise Stop at New Hong Kong Museum
×