The US Department of Justice announced Monday that it recovered much of the ransomware payment that Colonial Pipeline paid to free itself from the attack that derailed the oil and gas supplier’s operations for several days last month.

The seizure of 63.7 of the initial 75 paid bitcoins represented the first success of the Justice Department’s Ransomware and Digital Extortion Task Force, a team formalized just months ago, according to reporting from The Wall Street Journal. The value of the recovered bitcoins stands at roughly $2.3 million.

Justice Department Seizes $2.3 Million in Cryptocurrency Paid to Ransomware Extortionists: @TheJusticeDept today announced that it has seized 63.7 bitcoins that allegedly represent the proceeds of a May 8 ransom payment to DarkSide cyber actors. https://t.co/qnCAN8oibW pic.twitter.com/brNopjSN3E

— FBI (@FBI) June 7, 2021

Some commentators have speculated that the discrepancy between what was paid and what was recovered may be accounted for by the fact that Darkside ransomware is sold under the Ransomware-as-a-Service (RaaS) model. The missing money (about 15% of the total) may be the fee the attackers paid the Darkside creators for using their malware.

In statements prepared Monday, US Deputy Attorney General Lisa Monaco characterized the operation as a victory and a representation of the Justice Department’s full powers.

“Following the money remains one of the most basic, yet powerful tools we have,” Monaco said. “Ransom payments are the fuel that propels the digital extortion engine, and today’s announcement demonstrates that the United States will use all available tools to make these attacks more costly and less profitable for criminal enterprises. We will continue to target the entire ransomware ecosystem to disrupt and deter these attacks.”

Monaco added that the Department of Justice’s actions showcased the “value of early notification to law enforcement”—a clear signal that the federal government is now operating in lockstep to curb the threat of ransomware. In mid-May, the White House emphasized the importance of cyberattack notification when President Joe Biden signed an Executive Order that requires such warnings from technology companies that sell their products to the federal government, and weeks later, the Transportation Security Administration (TSA) rolled out a new cybersecurity directive for all US pipeline companies that will require pipelines to notify the government of any cyberattacks.

According to a sworn affidavit in support of a “seizure warrant” that was revealed Monday, Monaco’s statement about “following the money” was surprisingly literal. According to the affidavit, law enforcement tracked Colonial Pipeline’s payment across the public Bitcoin ledger until much of the payment landed in one specific Bitcoin address, which the outlet The Record identified here. After the funds arrived at the Bitcoin address—which law enforcement referred to as the “Subject Address”—they were not touched for days.

Then, a bit of mystery happened.

According to the affidavit, the Justice Department was able to retrieve funds from the Subject Address because the FBI obtained that address’s related “private key.”

Private keys are somewhat like passwords, in that they not to be shared, but they are also more complex than that. Private keys are randomized strings of letters and numbers that are cryptographically related to the Bitcoin address that they access. Reverse engineering a private key is technically infeasible, which means that somehow, the FBI obtained an example of possibly the most closely guarded secret for any cryptocurrency user today.

Some users keep their private keys on exchanges (websites for trading bitcoins). If the Colonial Pipeline attackers kept their key on a US-based exchange it would be an easy matter for the FBI to seize it. However, security-conscious Bitcoin users tend to keep their keys where they can see and secure them, on computers they own.

How the FBI managed managed to get the key is unclear, but a week after the Colonial Pipeline attack, Darkside said it lost control of some of its servers. In the same announcement, the threat actors also said they lost some ransom payments.

Whether the US government removed Darkside’s server access is not known, but the FBI’s ability to obtain a Bitcoin address private key still reveals a new attitude in America’s fight against cybercrime—a fierce, antagonistic approach that potentially crosses ethical lines.

In April, the Department of Justice revealed that the FBI had obtained the somewhat extraordinary authority to access servers it did not own or control so that it could remove web shells placed by cybercriminals who exploited zero-day vulnerabilities in on-premises versions of Microsoft Exchange Server software. These web shell removals were performed with no notification to the servers’ owners.

Similarly, in January, after the international law enforcement agency Europol announced that it had taken control of the Emotet botnet, cybersecurity researchers spotted something hidden. The law enforcement agencies responsible for the takedown had already planned to deploy an update to remove Emotet from infected machines, and law enforcement agencies themselves wrote the code for the deployment.

In speaking on our podcast Lock and Code, Malwarebytes Security Evangelist Adam Kujawa said this was a new tactic from government authorities.

“I’ve seen people maybe misuse or abuse or modify how a particular malware Command & Control infrastructure would work, but I’ve never seen law enforcement deploy brand new code, and that’s kind of worrying a lot of folks,” Kujawa said. “A lot of people might consider it illegal.”

---