Ransomware

:

Extortionists, Inc.

Criminals are extorting millions with ransomware like Netwalker. Rarely is anyone caught, but the FBI succeeded. Files from the investigation show how the gang operated.

Von Kai Biermann, Astrid Geisler und Zachary Kamel

1 Kommentar

Ransomware: Centre for IT Forensics of the FBI in New Orleans

Centre for IT Forensics of the FBI in New Orleans © [M] ZEIT ONLINE, Foto: Gerald Herbert/dpa

Extortionists, Inc. – Seite 1

Lesen Sie hier die deutsche Version des Artikels.

In March 2020, an innocuous-sounding job posting appeared on an internet forum called XSS. We’re looking for people who are more interested in quality than quantity, a person with the alias "Bugatti" wrote in Russian. "We give preference to those who know how to work with large networks." The listing stated that a limited number of "partners" were being sought. Applicants should include their specialties and work experience and indicate when they could start.

The job listing didn’t contain any information about the actual job or the company that was recruiting. But the FBI, the U.S. federal police force, was convinced that a group of cyber-extortionists, now known to the world as Netwalker, was looking for freelancers. That presumption is included in the investigation files that ZEIT ONLINE has obtained.

DAS BESTE AUS Z+

:

Digitales

Hacker

:

Meine Jagd auf Bagsu

"Bugatti," the FBI believes, was recruiting accomplices for crimes that have become something of a digital pandemic in recent years. Hackers smuggle ransomware programs into the IT networks of companies and public institutions, encrypt their data, and only release it again in exchange for significant ransom payments. At first, such crimes tended to target private individuals and their computers. In the meantime, though, tens of thousands of companies, organizations and city councils around the world have been struck, many of them with targeted attacks. The Netwalker group is just one of many thought to have made millions with the scam.

"The Threat Level Has Increased Significantly"

In his seemingly innocently worded job ad, "Bugatti" was apparently looking for IT professionals to assist his hacker group as external partners to extort ransom on an even larger scale. Investigators refer to these criminal helpers as "affiliates." The software provided, "Bugatti" wrote to entice potential applicants, "has gained a good reputation." He added that once something had been encrypted using the program, it could not easily be decrypted.

The FBI’s investigation into the Netwalker group documents a dangerous development: The individual ransomware gangs are likely quite small, but they are growing increasingly professional when it comes to organization. And that is boosting their ransom revenues. Germany’s Federal Office for Information Security likewise issued a warning in a current situation report: "In recent years, the threat level posed by ransomware has increased significantly."

Newsletter

HIER KOSTENLOS ANMELDEN

Seien Sie live online dabei, wenn unsere Podcasts entstehen, und treffen Sie Ihre Lieblingshosts zum ersten ZEIT ONLINE Podcastfestival am Sonntag, 20. Juni 2021.

Mit Ihrer Registrierung nehmen Sie die Datenschutzbestimmungen zur Kenntnis.

When the Netwalker ransomware first appeared in August 2019, it only played a minor role. By the following year, though, the group had grown to become one of the top five digital extortion gangs in the world, according to an analysis conducted by Chainalysis. The company specializes in tracking criminal payments in Bitcoin, the cryptocurrency in which most extortionist groups demand their ransom.

There are numerous extortion groups out there, and they all use different software programs to attack their victims, but the principle is always the same. But it looks as though only very few of them have made so much money in so little time with such little risk. The FBI estimates that the Netwalker group has extorted a total of 3,657.84 Bitcoin. The value of Bitcoin fluctuates wildly, but at the time of publication, that amount of Bitcoin had a value of around 109 million euros.

The Fee Is 25 Percent of the Ransom

There is much to suggest that this success went hand in hand with the use of affiliates – those external service providers that "Bugatti" sought to recruit through the internet forum.

The Netwalker ransomware gang built up a criminal franchise model through the use of these service providers. Franchising – the licensing of defined brands and sales models – is a common business practice in the legal economy. It is one that allowed a company like McDonald’s to become a global corporation. But franchising is something of a novelty in the world of cybercrime, and Netwalker was one of the first groups to adopt the concept. The consequence has been a sharp increase in the number of victims and in the amount of ransom extorted.

The people behind the gang concentrate on building the software. They put together off-the-shelf packages containing all the programs needed to secretly penetrate a foreign computer network, snoop around inside to find passwords, copy its data, and encrypt all the hard drives so that the victims can no longer use them. A tailor-made package is assembled for each target. The technical jargon for these packages is "builds," and those interested in using these builds pay a fee to the developers. The FBI believes that the people behind Netwalker receive 25 percent of the ransom, with the affiliates allowed to keep the remaining 75 percent.

User ID 128 Extorted the Most Money

One of those affiliates goes by "User ID 128," whose profile the FBI discovered on one of the Netwalker gang’s servers. He is thought to have been one of 68 affiliates working for the group. These freelancers allegedly used a total of 910 builds against an unclear number of victims between February and September of 2020.

What sets "User ID 128" apart is that investigators in the United States and Canada are convinced they have caught him. The suspect in question is 33-year-old Sébastien V., who has a degree in computer science from a university in Ottawa and worked for years in the IT departments of Canadian government agencies. (You can read more about Sébastien V. and another member of a similar ransomware gang here.) He has been in pre-trial custody since January, where he is currently awaiting a court ruling on a request for his extradition by the U.S.

Still, despite growing international efforts, investigators rarely succeed in identifying and arresting suspects. The men behind the ransomware schemes – women aren’t known to be involved – remain in the shadows to this day. The authorities have only managed to catch a few affiliates like "User 128."

Servers of Three Perpetrators Identified

Ultimately, Sébastian V. was nabbed because criminals also make mistakes.

The FBI launched its investigation into the Netwalker group in August 2019. The network is one of those groups that ratchets up the pressure on their victims by gradually publishing their data on the internet. Those who don’t pay up will be exposed and embarrassed – that is the threat. Documents related to that threat have been appearing at least since May 2020 on a page located on the Tor network, an anonymized part of the internet that can only be accessed with the use of a special browser.

The FBI was able to identify the server in Bulgaria that was used to post documents to the Tor site. The FBI also hacked one of the servers, located in Poland, that was used to attack one of the victims. The FBI said it also tracked down a second server in Poland that was used to publish data belonging to the victims.

With the help of the Polish and Bulgarian authorities, the FBI obtained complete copies of all server data from the operators. According to the investigation file, the first server was pre-loaded with 12 ready-to-use builds that already included the target addresses of the victims, an educational institution and a transport company among them.

On the second Polish server and the Bulgarian server, investigators then discovered clues that led directly to a suspect. They found hundreds of screenshots of data belonging to the victims, and the metadata from many of these screenshots included a name: Sébastien V. Apparently, he failed to take into account that such metadata is created every time a file is edited, and he forgot to delete it.

Suspect in Jail

Furthermore, someone had logged into a Gmail account from the IP address of one of the servers. Investigators were able to search that account with a judge’s permission. In that account, they found an order delivered to the address of Sébastien V. and references to another mail account, this one with Microsoft. The suspect had used it to create a cryptocurrency depot. Some 8,165 Bitcoin from one of the ransom payments allegedly flowed through it. And there were photos of V. holding his driver’s license into the camera. That was enough for the FBI to secure an arrest warrant and issue an extradition request. In January 2021, Canadian police arrested V. at the request of the U.S. Attorney’s Office.

The FBI considers V. to be the biggest fish among the Netwalker affiliates. "User 128" had been active since at least April 12, 2020, and nearly half of the group’s earnings, 1,433.57 Bitcoin, are thought to have flowed through his accounts. Furthermore, the investigation attributes 144 of the builds to him.

The Canadian judiciary is expected to rule on the extradition request against Sébastian V. in mid-July. When contacted by ZEIT ONLINE, his lawyer referred to the presumption of innocence, which he said also applies to his client.  He added that V. would respond to the allegations from the United States at the appropriate time.

Translator: Daryl Lindsey