Looks Like Law Enforcement Actually Shutdown DarkSide

A big hat tip to the work of law enforcement but which agency remains unknown at this point.

Shutting down the servers of DarkSide is a great achievement but not before there were other victims such as Toshiba.

A Toshiba Corp (6502.T) unit said it was hacked by the DarkSide ransomware group, overshadowing an announcement of a strategic review for the Japanese conglomerate under pressure from activist shareholders to seek out suitors.

Toshiba Tec Corp (6588.T), which makes products such as bar code printers and is valued at $2.3 billion, was hacked by DarkSide – the group widely believed to be behind the recent Colonial Pipeline attack, its French subsidiary said.

From Krebs:

The DarkSide ransomware affiliate program responsible for the six-day outage at Colonial Pipeline this week that led to fuel shortages and price spikes across the country is running for the hills. The crime gang announced it was closing up shop after its servers were seized and someone drained the cryptocurrency from an account the group uses to pay affiliates.

“Servers were seized (country not named), money of advertisers and founders was transferred to an unknown account,” reads a message from a cybercrime forum reposted to the Russian OSINT Telegram channel.

“A few hours ago, we lost access to the public part of our infrastructure,” the message continues, explaining the outage affected its victim shaming blog where stolen data is published from victims who refuse to pay a ransom.

“Hosting support, apart from information ‘at the request of law enforcement agencies,’ does not provide any other information,” the DarkSide admin says. “Also, a few hours after the withdrawal, funds from the payment server (ours and clients’) were withdrawn to an unknown address.”

DarkSide organizers also said they were releasing decryption tools for all of the companies that have been ransomed but which haven’t yet paid.

“After that, you will be free to communicate with them wherever you want in any way you want,” the instructions read.

The DarkSide message includes passages apparently penned by a leader of the REvil ransomware-as-a-service platform. This is interesting because security experts have posited that many of DarkSide’s core members are closely tied to the REvil gang.

The REvil representative said its program was introducing new restrictions on the kinds of organizations that affiliates could hold for ransom, and that henceforth it would be forbidden to attack those in the “social sector” (defined as healthcare and educational institutions) and organizations in the “gov-sector” (state) of any country. Affiliates also will be required to get approval before infecting victims.

The new restrictions came as some Russian cybercrime forums began distancing themselves from ransomware operations altogether. On Thursday, the administrator of the popular Russian forum XSS announced the community would no longer allow discussion threads about ransomware moneymaking programs.

“There’s too much publicity,” the XSS administrator explained. “Ransomware has gathered a critical mass of nonsense, bullshit, hype, and fuss around it. The word ‘ransomware’ has been put on a par with a number of unpleasant phenomena, such as geopolitical tensions, extortion, and government-backed hacks. This word has become dangerous and toxic.”

In a blog post on the DarkSide closure, cyber intelligence firm Intel 471 said it believes all of these actions can be tied directly to the reaction related to the high-profile ransomware attacks covered by the media this week.

“However, a strong caveat should be applied to these developments: it’s likely that these ransomware operators are trying to retreat from the spotlight more than suddenly discovering the error of their ways,” Intel 471 wrote. “A number of the operators will most likely operate in their own closed-knit groups, resurfacing under new names and updated ransomware variants. Additionally, the operators will have to find a new way to ‘wash’ the cryptocurrency they earn from ransoms. Intel 471 has observed that BitMix, a popular cryptocurrency mixing service used by Avaddon, DarkSide and REvil has allegedly ceased operations. Several apparent customers of the service reported they were unable to access BitMix in the last week.”

***

“The funds, which the Darkside gang was supposed to split between itself and its affiliates (the threat actors who breach networks and deploy the ransomware), were transferred to an unknown wallet, Darksupp said.” reported TheRecord.

The news was revealed by a member of REvil ransomware gang, known as ‘UNKN,’ in a forum post on the Exploit hacking forum. The post was first spotted by Recorded Future researcher Dmitry Smilyanets, it includes a message allegedly from DarkSide explaining how the gang lost access to their blog, payment servers, and DDoS servers as a result of an action conducted by law enforcement action. source

Darkside

“Since the first version, we have promised to speak honestly and openly about problems. A few hours ago, we lost access to the public part of our infrastructure, namely:

  • Blog.
  • Payment server.
  • DOS servers.”

reads the post from UNKN. “Now these servers are unavailable via SSH, the hosting panels are blocked. Hosting support, apart from information “at the request of law enfocement agencies”, does not provide any other information.”

 

The Harbinger of the Colonial Pipeline Ransomware

The harbinger is what protections against hacks and ransomware are underway? Stopping oil and gas flow and delivery is how to stop life and economies. Apply some critical thinking here…it goes way beyond cost as supply is crucial. If the FBI was well aware of the DarkSide in 2020….we need to rethink the Bureau completely.

PC Magazine provides this update in part:

The FBI today confirmed that the cyberattack that forced Colonial Pipeline to take its network offline over the weekend is due to ransomware known as DarkSide.

“The FBI confirms that the DarkSide ransomware is responsible for the compromise of the Colonial Pipeline networks,” the agency says. “We continue to work with the company and our government partners on the investigation.”

During a Monday White House press briefing, Anne Neuberger, Deputy National Security Advisor for Cyber and Emerging Technology, said the FBI has been investigating the DarkSide variant since October 2020, and has determined that it’s a ransomware-as-a-service attack, meaning “criminal affiliates conduct attacks and then share the proceeds with ransomware developers,” she said.

Though news reports have tied DarkSide to Russian operatives, President Biden said Monday that “so far, there’s no evidence…from our intelligence people that Russia is involved, although there is evidence that the actors [behind the ransomware are] in Russia, [so] they have some responsibility to deal with this.”

Colonial Pipeline cyberattack shuts down pipeline that ...

The Chicago Tribune along with other media sources post the notion that this should not last long:

The operator of a major U.S. pipeline hit by a cyberattack said Monday it hopes to have service mostly restored by the end of the week.

Colonial Pipeline offered the update after revealing that it had halted operations because of a ransomware attack the FBI has linked to a criminal gang.

The ransomware attack on the pipeline, which the company says delivers roughly 45% of fuel consumed on the U.S. East Coast, raised concerns that supplies of gasoline, jet fuel and diesel could be disrupted in parts of the region if the disruption continues.

At the moment, though, officials said there is no fuel shortage.

The Colonial Pipeline transports gasoline and other fuel through 10 states between Texas and New Jersey, according to the company.

Colonial is in the process of restarting portions of its network. It said Sunday that its main pipeline remained offline, but that some smaller lines were operational. The company has not said when it would completely restart the pipeline.

“The time of the outage is now approaching critical levels and if it continues to remain down we do expect an increase in East Coast gasoline and diesel prices,” said Debnil Chowdhury, IHS Markit Executive Director. The last time there was an outage of this magnitude was in 2016, he said, when gas prices rose 15 to 20 cents per gallon. But the Northeast had significantly more local refining capacity at that time, potentially intensifying any impact.

The FBI and others got the attribution right on this one and did so very quickly.

The group behind the ransomware that took down Colonial Pipeline late last week has apologized for the “social consequences,” claiming that its goal is to make money, not cause societal problems.

According to Vice, the group’s apology was posted to its dark web site. It reads:

We are apolitical, we do not participate in geopolitics, do not need to tie us with a defined government and look for other our motives.

Our goal is to make money and not creating problems for society.

From today, we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future.

According to NYT cybersecurity reporter Nicole Perlroth, DarkSide isn’t necessarily associated with a specific nationstate, but it does tend to avoid holding victims for ransom if their systems are running in certain Russian and Eastern European languages (see embedded tweet below). Bloomberg reports that the group is known to speak Russian.

Source:

Imagine the other worldwide pipeline systems and their respective responses such as all of Europe.

Natural gas pipelines of Europe and surrounding regions ...

 

Meet David Chipman, Biden’s New ATF Director

Biden announced his gun czar at a presser on April 8, 2021. Who is he?
Well, this cat wrote an opinion piece a few weeks ago. In part noted by Newsweek:

(…) declaring that the Constitution’s Second Amendment envisions firearms as being “well regulated.”

Chipman’s article, printed in The Roanoke Times, criticized local governments in Virginia that responded to state legislative firearm reform efforts by declaring themselves as “Second Amendment sanctuary” counties. These counties’ sheriffs and local officials claimed that the Constitution allowed them to block any laws that violated gun owners’ freedoms. “The Second Amendment envisions firearms as being ‘well regulated,’ and individual sheriffs aren’t entitled to decide whether a particular regulation is constitutional—that’s the job of the courts,” Chipman wrote. He also accused local sheriffs and officials of stoking fears, spreading lies and valuing “unregulated access to guns above the lives of their neighbors.”

Chipman studied justice as an American University undergraduate and studied management as a Johns Hopkins University master’s student.

A year after graduating from American University, he began a nearly 23-year career at the ATF. During that time, he worked as a special agent in charge of ATF’s firearms programs and also as a member of the ATF division bearing similarity to special weapons and tactics (SWAT) teams in police departments. He also reportedly disrupted a Virginia firearms trafficking operation that supplied illegal guns to New York City while working at the ATF.

Former ATF Special Agent David Chipman delivers remarks ...

After leaving the agency, he worked for a year and a month as a senior advisor for the municipal firearm reform advocacy group Everytown for Gun Safety. He also worked nearly three years as senior vice president of public safety solutions for ShotSpotter, a gunshot detection system.

***

Chipman, an ATF veteran, works also for the former Rep. Gabby Giffords team on gun control issues.

Reforms, rules and regulations, otherwise called initiatives include:

 

Beware…more to come.

 

Biden Ends Remain in Mexico, 25,000 Migrants Coming to U.S.

The plan offers one of the fastest pathways to citizenship of any proposed measure in recent years, it does so without offering any enhanced border security, which past immigration negotiations have used as a way to win Republican votes. Without enhanced security, it faces tough odds in a closely divided Congress.

The migrants are first in line to receive the Covid vaccine and the Biden immigration plan has no real chance to pass but in a comprehensive form but the president’s Executive Orders on immigration are forcing other other measures. ICE is not prepared and neither is Border Patrol. Further, schools, the medical systems along with housing, transportation, general employment are not prepared either. So, big taxpayer money will go to refugee resettlement along with free legal assistance to the migrant population. The plan includes $4 billion spread over four years to try to boost economic development and tackle corruption in Latin American countries.

Joe Biden's immigration reform plans must address enforcement

 

While the number of 11 million illegals has been broadcasted for years, that is hardly the real number. No one really knows how many are here, but various estimates from studies and agency reviews report the real number is closer to 20 million and could be as high as 30 million.

Meanwhile, there is no foreign policy discussions or plans to solve the issues in the failing countries such as Honduras, El Salvador, Mexico or Guatemala to list a few, just throwing money at those countries.

Biden's work cut out for him in plan to undo Trump ...

 

The first real mission is to challenge the exact number of how many illegals are in the United States and what the cost will be to taxpayers before any immigration legislation can move through Congress.

Biden’s plan includes the following:

  • An 8 year pathway to citizenship
  • Immediate green cards for agriculture workers
  • Green cards for Deferred Action for Childhood Arrivals (DACA)
  • No additional money for Border Patrol
  • $ billion over 4 years to confront corruption and foster prosperity (whatever that is)
  • Three 3 years to apply for citizenship
  • Re-unify children separated from parents (about 400 and most entered with mules and not parents as proven by DNA)
  • Reduce the time for citizenship from 13 years to 8 years.
  • For domestic arrests of illegals for criminal activity will require a phone call to Washington to get approval before the arrest.
  • Green cards for family members, how far within the family unit is unclear.
  • Changing word use including no more applying ‘alien’.
  • No consideration for visa over-stays or for E-Verify.
  • Increase diversity visas.

The Biden White House has posted a Immigration Bill Fact sheet

In part it includes:

  • Promote immigrant and refugee integration and citizenship. The bill provides new funding to state and local governments, private organizations, educational institutions, community-based organizations, and not-for-profit organizations to expand programs to promote integration and inclusion, increase English-language instruction, and provide assistance to individuals seeking to become citizens.
  • Grow our economy. This bill clears employment-based visa backlogs, recaptures unused visas, reduces lengthy wait times, and eliminates per-country visa caps. The bill makes it easier for graduates of U.S. universities with advanced STEM degrees to stay in the United States; improves access to green cards for workers in lower-wage sectors; and eliminates other unnecessary hurdles for employment-based green cards. The bill provides dependents of H-1B visa holders work authorization, and children are prevented from “aging out” of the system. The bill also creates a pilot program to stimulate regional economic development, gives DHS the authority to adjust green cards based on macroeconomic conditions, and incentivizes higher wages for non-immigrant, high-skilled visas to prevent unfair competition with American workers.

Grow the economy? Overload schools where many of them are not open?

  • Manage the border and protect border communities.  The bill provides funding for training and continuing education to promote agent and officer safety and professionalism. It also creates a Border Community Stakeholder Advisory Committee, provides more special agents at the DHS Office of Professional Responsibility to investigate criminal and administrative misconduct, and requires the issuance of department-wide policies governing the use of force. The bill directs the Government Accountability Office (GAO) to study the impact of DHS’s authority to waive environmental and state and federal laws to expedite the construction of barriers and roads near U.S. borders and provides for additional rescue beacons to prevent needless deaths along the border. The bill authorizes and provides funding for DHS, in coordination with the Department of Health and Human Services (HHS) and nongovernmental experts, to develop guidelines and protocols for standards of care for individuals, families, and children in CBP custody.

Manage Border Patrol? The real brain trust is already in the Border Patrol. Has President Joe even visited the border?

Border Walls and Pipelines, Unacceptable with Exceptions

So, the most immediate Executive Order signed by President Biden was to shutter the Keystone XL pipeline project. It has devastated the energy industry and the true costs to Americans are still growing outside the scope of higher prices of gasoline and the loss of jobs. The effects include revenues to states that provide funding the public education, tax increases, alterations in foreign policy and relations, slowing economic recovery across many industry sectors and destabilizing power sources for businesses and homes. For some finer points and financial context, go here. 

But, did you know the United States is actually funding a pipeline across Turkmenistan, Afghanistan, Pakistan and India? Yes, in all the peace talks with the Taliban, we have for decades been providing financial aid, the amount is too convoluted to determine but this goes back to collaboration between the United States and the Taliban and even Russia.

A Taliban delegation has paid a surprise visit to Turkmenistan to pledge support for a planned natural gas pipeline across Afghanistan, providing welcome reassurance for a project whose viability has long been rendered doubtful by security concerns.

Signs point to the trip having been brokered by the U.S. government, which has long championed what is known as TAPI, named after the four countries the pipeline would cross: Turkmenistan, Afghanistan, Pakistan and India.

Other projects alluded to by the Taliban spokesman are the Turkmenistan-Afghanistan-Pakistan high-voltage power transmission lines, or TAP, and railways from Turkmenistan to Afghanistan.

Should such reassurances hold, the main hurdle facing TAPI’s developers would be raising the necessary funds. Estimated costs for the project have been placed at anywhere up to $10 billion, although the chief executive of the TAPI Pipeline company, Muhammetmyrat Amanov, stated in 2018 that he was forecasting outlays closer to $7 billion.

Global energy majors have latterly shown no enthusiasm for TAPI, but that was not always the way. In 1997, a consortium comprised of six companies and the government of Turkmenistan was formed with the goal of building a 1,271-kilometer pipeline to Pakistan. India was not yet part of the plan. The largest share in that consortium, 54 percent, was held by California-based Unocal Corporation. In 1997, the American company even arranged travel to Texas for a senior Taliban delegation for negotiations. Deadly terrorist attacks in 1998 against U.S. embassies in Tanzania and Kenya organized by Al-Qaeda, whose leader Osama bin Laden had been provided safe haven by the Taliban, put paid to all that.

The Taliban was not entirely deterred, though. In 1999, the militant group, which had by then extended its control to almost all of Afghanistan, entered into talks on the route with Turkmenistan and Pakistan. Lack of cash and the rapidly evolving geopolitical landscape made it all pointless. By the end of that year, Turkmenistan had reached an agreement with Russia’s Gazprom on the delivery of 20 billion cubic meters of gas in 2000.Geofinancial: Turkmenistan Pushing TAPI, the Original ... source

Breakthroughs on the Afghan and Caspian fronts come at an extremely propitious time for Turkmenistan, which has struggled to find viable buyers for its vast gas reserves.

Turkmenistan is currently almost entirely reliant on China. Russia buys paltry amounts of gas.

Since the launch of the Central Asia-China pipeline in 2009, Turkmenistan has pumped 290 billion cubic meters of gas to China. But whereas it was once predicted that the Beijing-funded pipeline would be carrying 65 billion cubic meters of Turkmen gas annually by 2020, the entire route still only has capacity for 55 billion cubic meters per annum, and both Kazakhstan and Uzbekistan also use the pipeline.

Considering Turkmenistan has the fourth-largest reserves of natural gas in the world – an estimated 19.5 trillion cubic meters, nearly 10 percent of the world’s total – current export figures nowhere near reflect its potential. source

Crazy huh?

But hold on…there is the matter of Biden cancelling the border wall construction between the United States and Mexico.

Border walls around the world is a sign of the times and the Unites States also provides some foreign funding for walls far away. Someone ask Joe, Jen or Kamala about this…

Going back to 2016, Donald Trump promoted the construction of the border wall while the rest of the critics attacked the whole mission. The Atlantic in part included some of the top complaints. Clinton is suggesting that walls are useless against today’s borderless threats. Obama is suggesting that the world is marching toward ever-more interconnectedness, trampling the walls in its way. Both seem to present walls as a thing of the past. In fact, though, border walls and fences are currently going up around the world at the fastest rate since the Cold War

Ramo, a former journalist and the co-CEO and vice chairman of the consulting firm Kissinger Associates, applies network theory to international affairs. The fall of the Berlin Wall and the end of the Cold War helped usher in unfettered globalization, he argues, but now a backlash is underway. Globalization has gradually produced a desire in certain parts of the world for separation—particularly after a series of traumas, including the 9/11 attacks and the global financial crisis, exposed the hazards of freewheeling integration. And separation is increasingly being achieved through physical barriers.

The statistic Ramo cites about the spread of walls comes from a study by the political scientists Ron Hassner and Jason Wittenberg: Of the 51 fortified boundaries built between countries since the end of World War II, around half were constructed between 2000 and 2014. Hassner and Wittenberg found that such boundaries—structures like the existing U.S.-Mexico border fence, the Israel-West Bank barrier, and the Saudi Arabia-Yemen border fence—tend to be constructed by wealthy countries seeking to keep out the citizens of poorer countries, and that many of these fortifications have been built between states in the Muslim world.

“The walls, fences, and trenches of the modern world seem to be getting longer, more ambitious, and better defended with each passing year,” Ramo writes. “The creation of gates is … the corollary of connection.”

Recently, many of those fences have been appearing in Europe, as countries there struggle to process an influx of migrants and refugees. (The chart above doesn’t account for all of these new barriers, a number of which have been constructed since 2014.) The Economist observed in January that, as a result of the refugee crisis and the conflict in Ukraine, “Europe will soon have more physical barriers on its national borders than it did during the Cold War.” New border controls and barriers, including Austria’s proposed fence along the border with Italy, are threatening the viability of the European Union’s passport-free Schengen zone.

“Talking about walls or no walls is not the right discussion,” Ramo added. He would rather the discussion be about how gatekeeping should work, including questions like “what kind of immigration do we want to encourage and how do we want to structure that process.”

One of the reasons these trends are important is that they reframe the 2016 election from a contest between the past and the future, as Bill Clinton and Barack Obama imply, to one between two plausible futures. Ramo might call it a divide over the relative wisdom of more open versus more closed networks.

For an interactive migrant map for recent years go here. 

Hypocrisy right? The Daily Mail of the UK did a piece in 2015 of 65 countries that have erected walls and fences.