Pierluigi Paganini November 05, 2021

The US government offers up to a $10,000,000 reward for information leading to the identification or arrest of DarkSide gang members.

The US government wants to dismantle the DarkSide ransomware operation and its rebrands and it is offering up to a $10,000,000 reward for information leading to the identification or arrest of members of the gang in key leadership positions.

“The U.S. Department of State announces a reward offer of up to $10,000,000 for information leading to the identification or location of any individual(s) who hold(s) a key leadership position in the DarkSide ransomware variant transnational organized crime group.” reads the official announcement published by the US Department of Statement. “In addition, the Department is also offering a reward offer of up to $5,000,000 for information leading to the arrest and/or conviction in any country of any individual conspiring to participate in or attempting to participate in a DarkSide variant ransomware incident.”

The US Department of Statement also offers a $5,000,000 reward for information leading to the arrest of individuals who attempt to participate in a Darkside attack or an attack that is launched by one of its rebranded operations, such as BlackMatter.

DarkSide rebranded as BlackMater due to the pressure of international law enforcement after the attack that hit the Colonial Pipeline facility in May.

Yesterday, BleepingComputer reported that BlackMatter also shut down their operation after feeling “pressure from the authorities” and gang members going missing.

This week, the BlackMatter ransomware group has announced it is shutting down its operation due to pressure from local authorities. The announcement was published on the Ransomware-as-a-Service portal operated by the group used by the network of affiliates of the gang.

Cyber security group vx-underground published an image of the message and its translated version in English which states:

“Due to certain unsolvable circumstances associated with pressure from the authorities (part of the team is no longer available, after the latest news) – the project is closed. After 48 hours, the entire infrastructure will be turned off, it is allowed to:

-Issue mail to companies for further communication.
-Get decryptors, for this write “give a decryptor” inside the company chat where they are needed.

We wish you all success, we were glad to work. “

The BlackMatter group launched its operations the end of July, the gang claims to be the successor of Darkside and REvil groups. Like other ransomware operations, BlackMatter also set up its leak site where it publishes data exfiltrated from the victims before encrypting their system.

The US government offers the reward as part of the Department of State’s Transnational Organized Crime Rewards Program (TOCRP).

“The Department manages the TOCRP in close coordination with our federal law enforcement partners as part of a whole of government effort to disrupt and dismantle transnational organized crime globally, including cybercrime. More than 75 transnational criminals and major narcotics traffickers have been brought to justice under the TOCRP and the Narcotics Rewards Program (NRP) since 1986. The Department has paid more than $135 million in rewards to date.” concludes the announcement.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, DarkSide)

[adrotate banner=”5″]

[adrotate banner=”13″]