Saudi Press

Saudi Arabia and the world
Friday, Jul 11, 2025

Ransomware Attackers Up Ante as White House Vows Crack Down

Ransomware Attackers Up Ante as White House Vows Crack Down

A series of major cyber-attacks in recent weeks has underscored the brazenness of the attackers and the challenges of tackling the problem of ransomware, just as the Biden administration announced plans to take on the issue.

In a matter of days, attacks were revealed against the police department in Washington, D.C. , where the hackers threatened to release information about police informants to criminal gangs; the Illinois Attorney General’s office, which had been warned about weak cybersecurity practices in a recent state audit; and San Diego-based Scripps Health, where medical procedures were canceled and emergency patients diverted to other hospitals.

Then on Saturday, Colonial Pipeline confirmed that it had joined the list of recent ransomware victims in an attack that threatened to upend gasoline and diesel supplies on the East Coast. While few details about the attack are yet known, Colonial shut down the biggest gasoline pipeline in the U.S. as part of an effort to contain the threat.

“The recent ransomware attacks illustrate, by their number severity and range of targets, why we need to treat this problem on the level of a real national security threat both here and around the world,” said Christopher Painter, coordinator for cyber issues at the State Department under President Barack Obama. “Fortunately, people in our government are paying attention.”

The string of attacks came as the Biden administration has vowed to take on ransomware, which Department of Homeland Security Secretary Alejandro Mayorkas last week called “one of our most significant priorities right now.” His agency in March announced a 60-day sprint to address ransomware, and the Department of Justice has created its own ransomware task force.



Malicious Link

Ransomware is a type of malware -- often hidden in a phishing email or a malicious link -- that locks up a victim’s files, which the attackers promise to unlock for a ransom payment. More recently, ransomware groups have started stealing data and threatening to release it unless they are paid.

“It’s now a double-extortion scheme,” said Tyler Hudak, who handles incident response for the cybersecurity firm TrustedSec. “A lot of organizations will pay just to make sure their private data doesn’t get out.”

The scope of ransomware attacks is rapidly growing, with police departments, dental clinics, school districts and IT companies among the victims. Cybersecurity firm Emsisoft found that that almost 2,400 U.S. based governments, health-care facilities and schools were hit by ransomware in 2020.

A report released last month by a ransomware task force -- which included cybersecurity experts, government officials and academics -- said the amount paid by ransomware victims increased by 311% in 2020, reaching about $350 million in cryptocurrency. The average ransom paid by organizations in 2020 was $312,493, according to report.

So far, in addition to singling out ransomware, the Biden administration has also vowed to bolster defenses of critical infrastructure, including the electrical grid. The hackers behind the Colonial Pipeline attack took aim at both priorities, though it’s not clear if that was intentional.

While the investigation is still underway, a ransomware group called DarkSide appears to be behind the attack, according to Allan Liska, senior threat analyst at the cybersecurity firm Recorded Future.



Double Extortion

DarkSide first surfaced in August 2020 and uses the ransomware-as-a-service model, according to a blog post from the cybersecurity firm Cybereason. DarkSide uses the double extortion method in which it not only encrypts a victim’s data but exfiltrates it and threatens to make it public unless the ransom is paid, according to Cybereason.

“DarkSide is observed being used against targets in English-speaking countries and appears to avoid targets in countries associated with former Soviet Bloc Nations,” according to the blog.

While ransomware is primarily a profit-seeking venture perpetuated by criminals, there are allegations of foreign governments enabling or engaging in the attacks. Last year, the U.S. issued a warning about North Korea cyber crimes, including ransomware, saying the regime was increasing relying on illicit activity to generate money for weapons. In announcing sanctions against Russia in April, the Treasury Department stated that Russian intelligence cultivates and co-opts hackers “enabling them to engage in disruptive ransomware attacks and phishing campaigns.”

What to know in techGet insights from reporters around the world in the Fully Charged newsletter.
A major challenge in cracking down on ransomware is that many of the hackers operate out of countries that are unable or unwilling to prosecute them, making it difficult for authorities in the U.S. or elsewhere to bring them justice, according to the task force report. The hackers insist that ransom payments are made in cryptocurrency, making them difficult to track. It’s also relatively easy and cheap to launch ransomware, since some gangs now sell versions of the malware with instructions and customer service, a sort of criminal variation of the “software-as-a-service” model.

Another confounding issue is that many victims pay the ransom, something the FBI warns against because it encourages the attackers to target more victims and offers an incentive for others to get involved.

The task force report, prepared by the Institute for Security and Technology, includes 48 actions the Biden administration and the private sector could pursue for tackling ransomware, including using diplomacy and law enforcement to discourage foreign governments from providing a safe haven for ransomware gangs and imposing tougher regulation on cryptocurrency.

Painter, who was part of the task force, said it was a “timely call to action.” He added that “this problem will only get worse if we don’t address it now in a comprehensive way.”

Hudak said the success of ransomware gangs depends on establishing a reputation. That’s one reason many of them, including DarkSide, create pages on the dark web showing which companies they have attacked and files they’ve released from victims that don’t pay, he said.

“We’re working an incident right now where DarkSide is involved,” Hudak said. “They do research on their victims. They’ll know much money they make, whether they have cyber insurance and what that insurance will pay.”

Newsletter

Related Articles

Saudi Press
0:00
0:00
Close
BRICS Expands Membership with Indonesia and Ten New Partner Countries
Elon Musk Founds a Party Following a Poll on X: "You Wanted It – You Got It!"
AI Raises Alarms Over Long-Term Job Security
Saudi Arabia Maintains Ties with Iran Despite Israel Conflict
Russia Formally Recognizes Taliban Government in Afghanistan
Mediators Edge Closer to Israel-Hamas Ceasefire Agreement
Emirates Airline Expands Market Share with New $20 Million Campaign
House Oversight Committee Subpoenas Former Jill Biden Aide Amid Investigation into Alleged Concealment of President Biden's Cognitive Health
Amazon Reaches Major Automation Milestone with Over One Million Robots
Meta Announces Formation of Ambitious AI Unit, Meta Superintelligence Labs
China Unveils Miniature Insect-Like Surveillance Drone
Marc Marquez Claims Victory at Dutch Grand Prix Amidst Family Misfortune
Iran Executes Alleged Israeli Spies and Arrests Hundreds Amid Post-War Crackdown
Trump Asserts Readiness for Further Strikes on Iran Amid Nuclear Tensions
Iran's Parliament Votes to Suspend Cooperation with Nuclear Watchdog
Trump Announces Upcoming US-Iran Meeting Amid Controversial Airstrikes
Trump Moves to Reshape Middle East Following Israel-Iran Conflict
NATO Leaders Endorse Plan for Increased Defence Spending
U.S. Crude Oil Prices Drop Below $65 Amid Market Volatility
Explosions Rock Doha as Iranian Missiles Target Qatar
“You Have 12 Hours to Flee”: Israeli Threat Campaign Targets Surviving Iranian Officials
Oman Set to Introduce Personal Income Tax, First in Gulf
Germany and Italy Under Pressure to Repatriate $245bn of Gold from US Vaults
Iran Intensifies Crackdown on Alleged Mossad Operatives After Sabotage Claims
Trump Praises Iran’s ‘Very Weak’ Response After U.S. Strikes and Presses Israel to Pursue Peace
WATCH: Israeli forces show the aftermath of a massive airstrike at Iran's Isfahan nuclear site
We have new information and breaking details to share about what is shaping up to be a historic air campaign tonight
Six Massive Bombs Dropped on Fordow; Trump: 'A Historic Moment for the U.S., Israel, and the World'
Fordow: Deeply Buried Iranian Enrichment Site in U.S.–Israel Crosshairs
United States Conducts Precision Strikes on Iran’s Nuclear Sites
US strikes Iran nuclear sites, Trump says
Pakistan to nominate Trump for Nobel Peace Prize.
Israel Confirms Assassination of Quds Force Commander in Tehran
16 Billion Login Credentials Leaked in Unprecedented Cybersecurity Breach
Senate hearing on who was 'really running' Biden White House kicks off
G7 Leaders Fail to Reach Consensus on Key Global Issues
Mass exodus in Tehran as millions try to flee following Trump’s evacuation order
Iranian Military Officers Reportedly Seek Contact with Reza Pahlavi, Signal Intent to Defect
Vietnam Emerges as Luxury Yacht Destination for Ultra‑Rich
China's Iranian Oil Imports Face Disruption Amid Escalating Middle East Tensions
Trump Demands Iran's Unconditional Surrender Amid Escalating Conflict
Israeli Airstrike Targets Iranian State TV in Central Tehran
President Trump is leaving the G7 summit early and has ordered the National Security Council to the Situation Room
Netanyahu Signals Potential Regime Change in Iran
Analysts Warn Iran May Resort to Unconventional Warfare
Iranian Regime Faces Existential Threat Amid Conflict
Energy Infrastructure Becomes War Zone in Middle East
Iran Conducts Ballistic Missile Launches Amid Heightened Tensions with Israel
Iran Signals Openness to Nuclear Negotiations Amid Ongoing Regional Tensions
Shock Within Iran’s Leadership: Khamenei’s Failed Plan to Launch 1,000 Missiles Against Israel
×