Crypto News

International Operation Disrupts Ransomware Group Netwalker by Tracing Cryptos With the Help of Blockchain Analysis

International Operation Disrupts Ransomware Group Netwalker by Tracing Cryptos With the Help of Blockchain Analysis

In collaboration with Bulgarian authorities, the U.S. Department of Justice (DOJ) disrupted a well-known ransomware gang’s infrastructure. Law enforcement seized their servers and traced the illicit funds with the help of blockchain forensic analytics via Chainalysis.

US Authorities Seized Over $454,000 Worth of Cryptocurrencies

Per the U.S. Department of Justice’s announcement, the coordinated action took down Netwalker, a highly active ransomware group over the last year, specifically targeting the health care sector.

The U.S. authorities also indicted a Canadian national, Sebastien Vachon-Desjardins, who allegedly obtained $27.6 million as a “Netwalker affiliate.”

The authorities seized a server that hosted their site on the dark web, where the gang redirected their victims to arrange the ransom negotiations. Moreover, the U.S. DOJ said that $454,530.19 in cryptocurrency from ransom payments were seized.

With the support of blockchain analysis, law enforcement took advantage of investigative tools of Chainalysis to trace Netwalker transactions. In fact, the blockchain firm had traced more than $46 million worth of funds in Netwalker ransoms since it first came on the scene in August 2019.

The U.S. authorities believe the ransomware gang targeted 205 victims from 27 different countries during its lifetime, including 203 in the U.S.

Speaking with news.Bitcoin.com, Brett Callow, threat analyst at malware lab Emsisoft, commented on the authorities’ action against Netwalker:

Ransomware groups have operated with almost complete impunity for a very long time, which means there’s very little deterrent. The rewards are enormous, while the risks are small. The action against Netwalker changes that. In addition to disrupting the group’s revenue stream, it also sends a clear message that cybercriminals are not beyond the reach of the law. Will that create a deterrent? No, but it’s certainly a step in the right direction.

Netwalker ransomware works with an affiliate scheme, where external people could deploy the ransomware and share revenues with the gang. Chainalysis elaborates on what the blockchain analysis unveiled about the infrastructure:

Typically, there are four roles that receive proceeds from Netwalker attacks: the likely administrator or developer (8-10%), the affiliate (76-80%), and two commissioned roles (2.5%-5% each). An affiliate, like Vachon-Desjardins, is usually responsible for obtaining access to the victim network and deploying the malware. There are also cases when one wallet gets 100% of the payment, which we believe belongs to the Netwalker administrator and indicates that he or she may also be directly involved in some of the attacks.

The analytical firm says that there were fewer than 20 unique affiliates. Some of them rarely deployed the ransomware, while others moved on to other similar ransomware strains. That’s why a tool used by the authorities named Chainalysis Reactor traced payments received by the affiliates from other variants.

To confirm the fact that some affiliates moved to other strains, Chainalysis found out that Netwalker administrator published an advertisement on darknet forums. The admin was seeking new affiliates, as vacancies “had freed up.”

if (!window.GrowJs) { (function () { var s = document.createElement(‘script’); s.async = true; s.type = ‘text/javascript’; s.src = ‘https://bitcoinads.growadvertising.com/adserve/app’; var n = document.getElementsByTagName(“script”)[0]; n.parentNode.insertBefore(s, n); }()); } var GrowJs = GrowJs || {}; GrowJs.ads = GrowJs.ads || []; GrowJs.ads.push({ node: document.currentScript.parentElement, handler: function (node) { var banner = GrowJs.createBanner(node, 31, [300, 250], null, []); GrowJs.showBanner(banner.index); } });

Tracing Suspected Netwalker Affiliate

On how the authorities traced Vachon-Desjardins’ activities, Chainalysis explained:

Blockchain analysis revealed at least 345 addresses associated with Vachon-Desjardins going back to February 2018 with transactions continuing to the date of this writing (January 27, 2021). He allegedly received more than $14 million worth of bitcoin at the time of receipt of the funds, ultimately possessing at least $27.6 million given its rising value.

Citing government partners, Chainalysis claims Vachon-Desjardins was involved in at least 91 attacks using Netwalker ransomware since April 2020, deploying the malware as an affiliate and receiving 80% of the ransom. The analytical firm also suspects the alleged Netwalker affiliate was involved in the deployment of other ransomware strains.

What do you think about this massive operation against the Netwalker ransomware gang? Let us know in the comments section below.

How useful was this post?

Click on a star to rate it!

As you found this post useful...

Follow us on social media!

Disclaimer: The opinions expressed within this article are the personal opinions of the author. The facts and opinions appearing in the article do not reflect the views of CoinChapter and CoinChapter does not assume any responsibility or liability for the same.

(This story has not been edited by CoinChapter staff and is auto-generated from a syndicated feed.)
0 Comments
Inline Feedbacks
View all comments
CoinChapter

Founded in 2015, Coinchapter.com has become one of the leading resources for the crypto asset community. Created by a small group of cryptocurrency enthusiasts, Coinchapter.com was built to provide new members of the crypto asset community with unbiased listings of cryptocurrency exchanges and retail options that would allow them to buy the crypto assets that they wanted, how they wanted and at the price they wanted.

Related Crypto News

Yearn Finance Breaks Off Merger With Cover
Decentralized Finance protocols Yearn Finance and Cover Protocol announced the end of their protocol merger. “We have decided to...
John McAfee Indicted On Fraud & Money Laundering Charges For ‘Pump And Dump’ Scheme
John McAfee and his executive adviser Jimmy Gale Watson Jr. have been charged with securities fraud. Federal prosecutors believe...
PAID Network ($PAID) Crashes 70% In Minutes As Network Allegedly Exploited
$PAID, the native token of PAID Network, crashed by more than 70% in less than an hour. This is...
BitGo Acquires Trust License From New York Regulators
Digital asset custody BitGo has received a New York Trust license from the New York State Department of Financial...
Polkamarkets Collaborating With Bridge Mutual For Decentralized Insurance Coverage
Polkamarkets and Bridge Mutual jointly announced a partnership that will allow Polkamarkets’ users to claim decentralized finance (DeFi) risk...
MicroStrategy Purchases Additional 205 Bitcoin Valued At $10 Million
MicroStrategy CEO Michael Saylor announced the company has bought an additional 205 Bitcoins valued at roughly $10 million. This...

Featured Crypto News

Yearn Finance Breaks Off Merger With Cover
Decentralized Finance protocols Yearn Finance and Cover Protocol announced the end of their protocol merger. “We have decided to...
John McAfee Indicted On Fraud & Money Laundering Charges For ‘Pump And Dump’ Scheme
John McAfee and his executive adviser Jimmy Gale Watson Jr. have been charged with securities fraud. Federal prosecutors believe...
PAID Network ($PAID) Crashes 70% In Minutes As Network Allegedly Exploited
$PAID, the native token of PAID Network, crashed by more than 70% in less than an hour. This is...
BitGo Acquires Trust License From New York Regulators
Digital asset custody BitGo has received a New York Trust license from the New York State Department of Financial...
Polkamarkets Collaborating With Bridge Mutual For Decentralized Insurance Coverage
Polkamarkets and Bridge Mutual jointly announced a partnership that will allow Polkamarkets’ users to claim decentralized finance (DeFi) risk...
MicroStrategy Purchases Additional 205 Bitcoin Valued At $10 Million
MicroStrategy CEO Michael Saylor announced the company has bought an additional 205 Bitcoins valued at roughly $10 million. This...