Darkside Retreats to the Dark

After announcing that its criminal infrastructure has been taken down due to U.S. law enforcement pressure, the Darkside ransomware gang says it’s retreating. But is it?

4 hr ago

The Darkside gang began last Friday with a bang; but they may be ending their operations a week later with a whimper. Or they may be pulling another scam — this time to cheat affiliates out of their share of the ransom take.

After pulling in at least $9 million from two victims — $5 million paid by Colonial Pipeline on May 8 and about $4.4 million paid by the chemical distribution company Brenntag on May 11 — the developers behind the Darkside ransomware went offline.

Their dark web site — previously accessible only through the Tor browser — became unavailable on Thursday, and someone from a rival ransomware gang posted a message to a forum that was purportedly from the developer of the Darkside ransomware code. The message said the Darkside founders had lost access to the site where they hosted and published data stolen from ransomware victims who refused to pay, and they also lost access to the payment server and other infrastructure they need to collect payment and run their operations.

“A few hours ago, we lost access to the public part of our infrastructure, namely : Blog, Payment server, DOS servers,” reads a since-deleted message from a user called Darksupp, according to The Record, a publication of Recorded Future. The service provider that hosted the infrastructure told the Darkside operators that the sites and servers were taken down “at the request of law enfocement [sic] agencies.” Darksupp also said that cryptocurrency had been withdraw from the wallet they used to store payments from ransomware victims.

There’s reason to believe that at least some of this is true. Reuters and Bloomberg reported earlier this week that companies assisting Colonial Pipeline in their response to the incident worked with the FBI to get a hosting provider in New York to shut down a server that was storing data stolen from Colonial Pipeline before the thieves could transfer it to Russia, where the perpetrators are believed to be based.

And on Friday, Elliptic, a blockchain analytics company which also makes compliance tools for cryptocurrency businesses to monitor transactions, reported that it had identified the Bitcoin wallet used by the Darkside gang. The company said that on Thursday, the wallet — which still held $5 million in Bitcoin — was emptied.

Some have suggested this could be a ruse on the part of the Darkside gang to avoid sharing ransom proceeds with their affiliates who carried out the ransomware operation against Colonial Pipeline. Without knowing where the funds went, however, it’s difficult to know if the FBI seized it or if the Darkside gang emptied the wallet themselves.

The wallet, according to Elliptic, became active on March 4th and received 57 payments from 21 other Bitcoin wallets, totalling $17.5 million.

“Some of these payments directly match ransoms known to have been paid to DarkSide by other victims, such as 78.29 BTC (worth $4.4 million) sent by chemical distribution company Brenntag on May 11,” the company noted.

If authorities did seize $5 million in Bitcoin that was still sitting in the Darkside wallet, it’s only a fraction of what the criminal syndicate had already laundered out of the wallet since March.

According to Elliptic, about 18% of the wallet’s contents was sent to a small group of cryptocurrency exchanges, where Bitcoin is traded among buyers and sellers. “This information will provide law enforcement with critical leads to identify the perpetrators of these attacks,” the company noted. “An additional 4% has been sent to Hydra, the world’s largest darknet marketplace, servicing customers in Russia and neighboring countries.”

Hydra allows users to cash out their Bitcoin by converting it to cash or loading sums onto prepaid debit or gift cards.

In addition to Darkside’s retreat, another top ransomware group known as REvil has announced that it plans to stop advertising its ransomware service and instead “go private” by working with only a small group of trusted affiliates, The Record reported.

Some are cautioning that the moves by Darkside and REvil don’t mean their activity will stop; just that the operators plan to become less flashy in order to attract less law enforcement attention.

“I sincerely hope the Infosec community and media don’t lose their minds over thinking DarkSide is actually shutting down when it’s almost certainly a rebranding attempt to avoid the heat,” Robert M. Lee, CEO of the security firm Dragos wrote on Twitter on Friday.

https://zetter.substack.com/p/darkside-retreats-to-the-dark

May 13, 2021

Applied Adhesives Acquires Adhezion

May 13, 2021

Applied Adhesives Acquires Adhezion

May 12, 2021

Quality Carriers Sells to CSX

Tampa chemical trucking company sold to CSX in ‘game-changer’ shipping deal

Quality Carriers, which moves bulk chemicals across North America, will vastly expand the rail company’s shipping network.

Tampa's Quality Carriers is being sold to the CSX Corp., creating a sprawling new multimodal liquid chemical shipping network. — Tampa’s Quality Carriers is being sold to the CSX Corp., creating a sprawling new multimodal liquid chemical shipping network. [ DYLAN MCCULLOUGH | Quality Distribution ]

By Jay CridlinPublished 3 hours agoUpdated 34 minutes ago

A Tampa chemical trucking company is being sold to railroad giant CSX Corp. in a deal expected to create a sprawling rails-to-roadways chemical distribution network across North America.

Quality Distribution, a privately held logistics and transportation company headquartered in downtown Tampa, is spinning off and selling its Quality Carriers arm, which operates North America’s largest shipping network for bulk liquid chemicals like fuels, acids and fertilizers.

Quality Carriers, whose fleet includes 2,500 drivers moving between more than 100 hubs and terminals throughout North America, will remain based in Tampa.

Terms of the sale were not disclosed. The deal is expected to close in late summer or early fall.

In statements released Wednesday, executives from both companies highlighted the scope and potential impact of the deal. The companies’ “unique and seamless rail-to-highway offering,” said Quality Controls president Randy Strutz, would be the “first of its kind,” said CSX president and CEO James Foote.

In a statement, Quality Distribution chairman and CEO Gary Enzor called the deal “a game-changer for our industry.”

“This transaction gives CSX and Quality Carriers the unique opportunity to offer a powerful combination of truck and rail solutions to customers, with the added benefit of maintaining QC’s headquarters in Tampa,” Enzor said.Related: $2 billion packaging company relocating HQ to Tampa, bringing 200 jobs

In a brief video addressed to Quality Carriers drivers, Strutz said the deal would lead to “more opportunities and more choices” for truckers who prefer both local and long-haul jobs.

As part of the deal, Quality Distribution will spin another subsidiary, Boasso Global, into its own standalone company, and cease using the Quality Distribution brand name. Boasso provides shipping services for bulk shipping containers through a network of hubs in North America and Europe. It will continue to be based in Tampa.

Company officials said 99 percent of Quality Distribution’s workforce will remain in place, with most changes taking place at the corporate management level. Enzor will step down as Quality Distribution’s chariman and CEO, but will remain on Boasso’s board of directors. Joe Troy, Boasso’s executive vice president and chief financial officer, will step up and become CEO.Related: Clearwater’s MarineMax buys Wisconsin yacht builder for $63 million

Founded in 1913 in Pennsylvania, Quality Distribution has been based in the Tampa Bay area for decades. In 2015, the company was sold for $800 million to private equity firm Apex Partners. The previous year, the company had reported $991.7 million in revenue and $20.6 million in net income.

Based in Jacksonville, CSX last year reported nearly $10.6 billion in revenue, including $2.3 billion from its chemical transportation business, the most of any sector. The company’s intermodal business, linking trains and trucks, represented around 16 percent of its overall revenue.

https://www.tampabay.com/news/business/2021/05/12/tampa-chemical-trucking-company-sold-to-csx-in-game-changer-shipping-deal/