Archives for June 2021

US recovers most of ransom paid after Colonial Pipeline hack

WASHINGTON (AP) — The Justice Department has recovered most of a multimillion-dollar ransom payment made to hackers after a cyberattack that caused the operator of the nation’s largest fuel pipeline to halt its operations last month, officials said Monday.

The operation to seize cryptocurrency paid to the Russia-based hacker group is the first of its kind to be undertaken by a specialized ransomware task force created by the Biden administration Justice Department. It reflects a rare victory in the fight against ransomware as U.S. officials scramble to confront a rapidly accelerating threat targeting critical industries around the world.

“By going after the entire ecosystem that fuels ransomware and digital extortion attacks — including criminal proceeds in the form of digital currency — we will continue to use all of our resources to increase the cost and consequences of ransomware and other cyber-based attacks,” Deputy Attorney General Lisa Monaco said at a news conference announcing the operation.

Georgia-based Colonial Pipeline, which supplies roughly half the fuel consumed on the East Coast, temporarily shut down its operations on May 7 after a gang of cybercriminals using the DarkSide ransomware variant broke into the company’s computer system. The ransomware variant used by DarkSide, which has been the subject of an FBI investigation since last year, is one of more than 100 that law enforcement officials are now scrutinizing, said FBI Deputy Director Paul Abbate.

Colonial officials have said they took their pipeline system offline before the attack could spread to its operating system, and decided soon after to pay ransom of 75 bitcoin — then valued at roughly $4.4 million — in hopes of bringing itself back online as soon as it could. The company’s president and chief executive, Joseph Blount, is set to testify before congressional panels this week.

In a statement Monday, Blount said he was grateful for the FBI’s efforts and said holding hackers accountable and disrupting their activities “is the best way to deter and defend against future attacks of this nature.

“The private sector also has an equally important role to play and we must continue to take cyber threats seriously and invest accordingly to harden our defenses,” he added.

Cryptocurrency is favored by cybercriminals because it enables direct online payments regardless of geographical location, but in this case, the FBI was able to identify a virtual currency wallet used by the hackers and recovered the proceeds from there, said the FBI’s Abbate. The Justice Department did not provide details about how the FBI had obtained a “key” for the specific bitcoin address, but said law enforcement had been able to track multiple transfers of the cryptocurrency.

“For financially motivated cyber criminals, especially those presumably located overseas, cutting off access to revenue is one of the most impactful consequences we can impose,” Abbate said.

Though the FBI generally discourages the payment of ransom, fearing it could encourage additional hacks, Monaco said one takeaway for the private sector is that if companies come quickly to law enforcement after ransomware incidents, officials may be able to again help recover funds — though that is not guaranteed.

The Bitcoin amount seized — 63.7, currently valued at $2.3 million after the price of Bitcoin tumbled— amounted to 85% of the total ransom paid, which is the exact amount that the cryptocurrency-tracking firm Elliptic says it believes was the take of the affiliate who carried out the attack. The ransomware software provider, DarkSide, would have gotten the other 15%.

“The extortionists will never see this money,” said Stephanie Hinds, the acting U.S. attorney for the Northern District of California, where a judge earlier Monday authorized the seizure warrant.

Ransomware attacks — in which hackers encrypt a victim organization’s data and demand a hefty sum for returning the information — have flourished across the globe. Last year was the costliest on record for such attacks. Hackers have targeted vital industries, as well as hospitals and police departments.

Weeks after the Colonial Pipeline attack, a ransomware attack attributed to REvil, a Russian-speaking gang that has made some of the largest ransomware demands on record in recent months, disrupted production at Brazil’s JBS SA, the world’s largest meat processing company.

The ransomware business has evolved into a highly compartmentalized racket, with labor divided among the provider of the software that locks data, ransom negotiators, hackers who break into targeted networks, hackers skilled at moving undetected through those systems and exfiltrating sensitive data — and even call centers in India employed to threaten people whose data was stolen to pressure for extortion payments.

_____

Associated Press writer Frank Bajak in Boston contributed to this report.

___

Follow Eric Tucker on Twitter at http://www.twitter.com/etuckerAP

The Latest: Foundation to spend $1.3B to vaccinate Africans

TORONTO — The Mastercard Foundation says it will spend $1.3 billion over the next three years to acquire and deliver COVID-19 vaccines for more than 50 million people in Africa.

The first-of-its-kind initiative from the Mastercard Foundation is aiming to bolster Africa’s lagging vaccination campaign amid widespread fears of a third wave of infections on the continent.

The foundation will purchase single-dose Johnson & Johnson vaccines at the discounted rate negotiated by the African Union during its 220 million dose deal with the vaccine manufacturer. A spokeswoman says the doses will become available in August.

The announcement Tuesday from the Toronto-based Mastercard Foundation, which has more than $39 billion in assets, comes days after the World Health Organization said Africa was encountering an alarming mix of a spike in virus cases and “a near halt” of vaccine shipments. The delays have been tied to India’s halt on vaccine exports, among other things.

The Africa Centers for Disease Control and Prevention is partnering with the foundation and will consult African government agencies and other institutions on how to best deploy the shots among the 55 African Union nations.

___

Apple previews new software for iPhone, other gadgets

NEW YORK (AP) — Apple kicked off its second annual all-virtual developer conference with a keynote that outlined new updates to its software for iPhones and other devices. The presentation highlighted more privacy options for paid iCloud accounts and a “Find My” service that helps find errant AirPods, but included no major product announcements.

The latest renovations in Apple’s $2 trillion empire come at a pivotal time for the Cupertino, California, company. Apple is facing legal and regulatory threats to its control over its App Store, a so-called “walled garden” that produces substantial profits for the company.

Apple CEO Tim Cook, Craig Federighi, Apple’s senior vice president of software engineering, and other executives outlined updates to software for Apple’s many devices including its MacBooks, iMacs, iPhone, iPad and Watch.

Apple’s new MacOS software, dubbed Monterey, supports what Apple calls “universal control,” which lets people use one mouse and keyboard to control an iMac desktop computer, MacBook laptop and iPad at the same time.

Forrester analyst Julie Ask said the improvements Apple showed off, like the “universal control,” play to Apple’s strengths in blending its products and services.

“The news today was nothing ‘new new,’ like holy cow how did they make that happen,” she said. “But each of us picks up our phone 100 or 200 times a day, and they’re making 100 little moments a day better, more seamless, and easier.”

She pointed out Apple’s plan to support digital IDs including drivers licenses and state IDs from “participating U.S. states” in its digital wallet, as another example. Apple did not identify which states that will include.

“They have an army of people trying to get these deals signed,” she said. “Apple gets a lot of criticism for being so controlling. But they can do things other big brands struggle to do.”

A “Live Text” feature in iOS 15 will let you highlight text in photos and copy and paste it or look it up online. It will also integrate Air Pods into its “Find My” service, which helps people find lost or misplaced Apple products.

Apple is introducing more privacy features to its paid iCloud plans, including a way to hide your email address, encrypt video, and a “Private Relay” feature of Safari that encrypts data from the web browser similar to a VPN.

Paid plan pricing isn’t changing. Users pay for any iCloud storage above the free 5GB storage users get for free. In the U.S., those plans start at $1 a month for 50GB of storage.

Apple didn’t announce when iOS 15 will be available, but the company traditionally releases the free updates to all compatible iPhones in September.

___

AP technology reporter Michael Liedtke contributed to this article from San Ramon, Calif.

Lobster lovers feeling the pinch as summer nears

PORTLAND, Maine (AP) — Summer weather has arrived, and New England tourists are hungry for a lobster roll or a whole cooked lobster — but they’re going to have to pay up.

Lobster is more expensive than usual this season due to a limited supply, high demand and the reopening of the economy as the nation moves past the coronavirus pandemic. Consumers are headed back to seafood restaurants and markets for the first time in months, and the lobsters there to greet them are at a premium.

Some Maine stores charged $17 or $18 per pound for live lobster in May, and that was about twice the price a year ago. Prices are lingering in the $13 or $14 range this month. Lobster is usually expensive in late spring, but this season has seen prices that are higher than typical.

The wholesale price for live, 1.25-pound lobsters in the New England market was $9.01 per pound on May 1, business publisher Urner Barry reported. That was about $2.70 per pound more than the previous May 1, and the highest price for that date in at least five years, the company reported.

The high lobster prices are an indicator that customers are looking to get back out to restaurants, and that high-end seafood is in high demand, said John Sackton, an industry analyst and founder of SeafoodNews.com.

“It’s the strength of food service, and trying to gear up for what they think is going to be a strong summer,” Sackton said. “That’s pushing the price on a lot of these items that can draw traffic and are kind of must-have on a casino menu or something like that.”

Other factors influencing the high prices include a lack of available inventory and what appears to be a slow start to the fishing season. New England’s busiest lobster fishing season takes place in summer, and many harvesters are just starting to get their traps into the water.

“The fishermen will tell you, check back at the end of the season, then they’ll know whether they had a good season,” said Beth Casoni, executive director of the Massachusetts Lobstermen’s Association.

U.S. lobster fishing is based primarily in Maine, though many lobsters also come ashore in Massachusetts, Rhode Island and New Hampshire. Fishermen managed to have a productive season in 2020 despite the economic damage caused by the coronavirus pandemic.

Maine fishermen brought more than 96 million pounds of lobsters to the docks, and while that was the lowest total since 2010, it was still much more than they typically caught in the 1990s.

Pipeline exec to face Congress as US recovers most of ransom

WASHINGTON (AP) — The chief executive of the massive fuel pipeline hit by ransomware last month is expected to detail his company’s response to the cyberattack and to explain his decision to authorize a multimillion-dollar payment when he testifies before Congress this week.

Colonial Pipeline CEO Joseph Blount will face the Senate Homeland Security Committee on Tuesday, one day after the Justice Department revealed it had recovered the majority of the $4.4 million ransom payment the company made in hopes of getting its system back online. A second hearing is set for Wednesday before the House Homeland Security Committee.

Blount’s testimony marks his first appearance before Congress since the May 7 ransomware attack that led Georgia-based Colonial Pipeline, which supplies roughly half the fuel consumed on the East Coast, to temporarily halt operations. The attack has been attributed to a Russia-based gang of cybercriminals using the DarkSide ransomware variant, one of more than 100 variants the FBI is currently investigating.

The company decided soon after the attack to pay ransom of 75 bitcoin, then valued at roughly $4.4 million. Though the FBI has historically discouraged ransomware payments for fear of encouraging cyberattacks, Colonial officials have said they saw the transaction as necessary to resume the vital fuel transport business as rapidly as possible.