TOP CRYPTORANSOMWARE PAYMENTSREPORT

TOP CRYPTO RANSOMWARE
PAYMENTS REPORT
Prepared by Immune
The team at Immune , the leading bug bounty and security services platform
for web3 which protects over $60 billion in user funds, has created acomprehensive listing of the top crypto ransomware payments in the industry
by reviewing open source data.

Crypto Ransomware
Ransomware attacks use ransomware, which is a form of malware designed toencrypt les on a device or entire network and make them inaccessible.
Ransomware groups carry out these attacks and then demand a ransom inreturn for returning control of those systems.
With the growth of cryptocurrencies like Bitcoin, ransomware attacks saw a
noticeable increase in popularity, as ransomware groups have come to believethat cryptocurrency is anonymous, untraceable, and can facilitate much larger
ransom payments than traditional nancial systems.

If you’re a developer thinking about a bug-hunting career in web3, we gotyou. Check out our Web3 Security Library, and start taking home some of
the $144M in rewards available on Immune — the leading bug bountyplatform for web3.

fififffifi

https://immune .com/

Top Crypto Ransomware Payments
The top crypto ransomware payments total $69,316,140 across 10 speci csituations.

CNA Financial$40,000,000

JBS$11,000,000

CWT$4,500,000

Brenntag$4,400,000

Colonial Pipeline*$4,400,000

Travelex$2,300,000

UCSF$1,140,895

BRB Bank$957,245

Jackson County,Georgia$400,000

University ofMaastricht*$218,000*Colonial Pipeline recovered $2,300,000 from the ransom payment, and theUniversity of Maastricht recovered the full ransom payment amount. When
recovered, the total Bitcoin value from Maastricht’s payment was worth $510,000.

fi2

Top Crypto Ransomware Payments
Overview

ProjectRansom
Payment

CNA Financial$40,000,000 N/A

Phoenix

BitcoinRussiaJBS$11,000,000 N/A

REvil/Sodinokibi Bitcoin

RussiaCWT$4,500,000

Ragnar Locker

Bitcoin

N/A

BitcoinEasternEuropeBrenntag$4,400,000

Funds
Recovery

N/A

N/A

Ransomware
StrainCryptocurrency Origin

DarkSide

Colonial
Pipeline$4,400,000$2,300,000

DarkSide

BitcoinEasternEurope

Travelex$2,300,000

N/A

REvil/Sodinokibi Bitcoin

RussiaN/A

NetwalkerRansomware

Bitcoin

N/A

UCSF$1,140,895$957,245

N/A

LockBit

BitcoinEasternEurope

Jackson County,$400,000
Georgia

N/A

SamSamBitcoinIran$218,000*

Clop
Ransomware

BitcoinRussiaBRB Bank

University ofMaastricht$218,000* When recovered, the total Bitcoin value was worth $510,000.

3Top 5 Cases

CNA Financial$40,000,000
JBS$11,000,000
CWT$4,500,000
Brenntag$4,500,000
Colonial Pipeline$4,400,000**Colonial Pipeline recovered $2,300,000 from the ransom payment.

4

Ransom Recovery
In total, $2,518,000 has been recovered from ransom payments in 2 speci csituations. This number makes up 3.6% of the top crypto ransomware
payments.

Colonial Pipeline
Ransom $4,400,000
Recovered $2,300,000
University of Maastricht
Ransom $218,000
Recovered $218,000** When recovered, the total Bitcoin value was worth $510,000.

fi5

Detected Ransomware Strains
Researchers have detected 8 speci c strains of ransomware connected to thetop crypto ransomware payments. REvil/Sodinokibi and DarkSide are key actors
based on the total number of attacks, but the Phoenix group had the highestpro ting attack.

Phoenix CryptoLocker
While Phoenix CryptoLocker has been connected to only one of the top crypto
ransomware payments cases, it was responsible for the biggest one at$40,000,000 (CNA Financial), which represents 57.7% of the top crypto
ransomware payments. Phoenix is believed to be a newer variant of theransomware family released by Evil Corp, a Russian-based cybercriminal group.

CNA website shutdown caused by the ransomware attack (Source)

fifi6Detected Ransomware Strains
Phoenix CryptoLocker
Evil Corp has allegedly been behind some of the worst hacks of the past decade.
Phoenix CryptoLocker entered the list of suspected ransomware variants
created by Evil Corp, including DoppelPaymer, Grief, WastedLocker, Hades, andMacaw.

Phoenix CryptoLocker ransomware message (Source)

REvil/Sodinokibi
The group REvil/Sodinokibi, and its malware by the same name, were connected
to two attacks: JBS USA Holdings Inc. and Travelex, pro ting a total of$13,300,000, which represents 19.2% of the top crypto ransomware payments.
REVil/Sodinokibi ransomware is a Ransomware-as-a-Service (RaaS) operation
believed to originate from Russia or Eastern Europe, as reports show the groupdoesn’t target Russian-based organizations. Additionally, the ransomware codeveri es that the victims are not located in countries belonging to the
Commonwealth of Independent States, a regional intergovernmentalorganization in Eurasia. REVil/Sodinokibi is likely an o shoot of GandCrab, a
now-defunct notorious cybercrime gang, as REvil rst became active directly
after GandCrab shut down, and the malware share a signi cant amount ofcode.

fififffifi7

Detected Ransomware Strains
DarkSide
DarkSide was connected to two cases. The group was responsible for the attacks
on Brenntag and Colonial Pipeline, pro ting a total of $8,800,000, which
represents 12.7% of the top crypto ransomware payments.

Private data leak page sent to Brenntag (Source)

DarkSide is a cybercrime group believed to be based in Eastern Europe that
often operates via a Ransomware-as-a-Service (RaaS) model and also employs
direct extortion. The group has a history of attempting double ransom
payments–in other words, a payment to unlock the a ected systems and an
additional payment to prevent ex ltrated data from being made public.
DarkSide is also known for publishing a code of conduct that lists acceptabletargets. These targets are for-pro t companies in English-speaking countries.
The list of unacceptable targets includes hospitals, hospices, schools,universities, nonpro t organizations, and government agencies. Other
protected entities included the Commonwealth of Independent States, aregional intergovernmental organization in Eurasia.

fffifififi8

Detected Ransomware Strains
DarkSide

DarkSide Leaks: example of charity and targets public posts (Source)9Detected Ransomware Strains
Ragnar Locker
Ragnar Locker was responsible for the CWT attack, the third largest attack on
the list, pro ting $4,500,000, which represents 6.5% respectively.
Ragnar Locker is the name of the ransomware group and the malware it uses.
Similar to DarkSide, Ragnar Locker has been known for the double ransom
payment tactic and speci cally for regularly changing their obfuscation
techniques. The group has often targeted critical infrastructure, such as energy,manufacturing, nancial, government, and IT organizations.

Ragnar Locker Ransomware Message (Source)

fififi10Detected Ransomware Strains
Ragnar Locker

CWT Ransomware Attack Payment Negotiations (Source)11

Detected Ransomware Strains
Netwalker Ransomware
Netwalker ransomware, designed by the Circus Spider group, was responsible
for the UCSF attack, pro ting a total of $1,140,895, which represents 1.6% of
the top crypto ransomware payments.
The Circus Spider group quickly shifted Netwalkers’s model to Ransomware-asa-Service, much like its competitors, to increase its expansion and adoption,
allowing them to operate on a larger scale, target more organizations, andincrease the size of ransoms. While Netwalker operated like most otherransomware variants, it went further than holding its victim's data hostage.
Circus Spider has also been known for immediately leaking parts of the stolen
data online at the same time that it demanded the ransom payment. Failure tocomply in time meant that Circus Spider would upload the remaining stolen
data to the dark web.
LockBit
The LockBit group, one of the largest international ransomware groups, wasresponsible for the BRB Bank attack, pro ting a total of $957,245, which
represents 1.4% respectively.
The group is believed to operate out of Eastern Europe and has developed asophisticated piece of malware called LockBit, named after itself. The group uses
the Ransomware-as-a-Service model and frequently invents new ways to beat itscompetition.
The ransomware is advertised among its community as the fastest and moste cient encryption software and is notable for additional tactics, such as theStealBit malware, which automates data ex ltration. LockBit is used for highlytargeted attacks on corporate and enterprise organizations.

fifififfi

12Detected Ransomware Strains
SamSamThe SamSam group, responsible for the Jackson County attack, pro ted a total
of $400,000, which represents 0.6% respectively.

SamSam Ransomware Message (Source)

SamSam, also known as Samas or SamsamCrypt, is believed to be created,distributed, and operated from Iran. SamSam has specialized in targetedransomware attacks, breaking into networks, and encrypting multiple
computers across an organization before issuing a high-value ransom demand.
A trait of the SamSam group has been to thoroughly monitor networks and user
activities for an extended period before demanding a ransom payment.
The group has targeted multiple entities across di erent industries and criticalinfrastructure to increase its chance of a big payout for data recovery, such as
the transportation, education, and health sectors. While most of the attacks
targeted organizations in the United States, other attacks have been reported
in the UK, France, Portugal, Australia, Canada, Israel, and the Middle East.

fiff13Detected Ransomware Strains
Clap Ransomware
The Clop ransomware, distributed by the TA505 group, was responsible for theUniversity of Maastricht attack, pro ting $218,000, which represents 0.3%
respectively.
The Clop ransomware, named after the Russian word “klop,” which means “bedbug”, is believed to be distributed by the Russian cybercrime group TA505. The
group is known for its attacks against nancial and public institutions and retailcompanies using malicious spam campaigns and di erent kinds of malware.
The Clop ransomware encrypts pictures, videos, music, databases, and papers,
preventing victims from accessing personal data. Urgent data recovery is often
necessary for public institutions, which makes them an appealing target for suchattacks.

Russia 4
Eastern Europe 3
Iran 1

Origin of Detected Ransomware Strains

fffifi14BITCOIN AS A
RANSOM PAYMENT
WHY?
All $69,316,140 in ransom payments was paid in Bitcoin. With several ransom
payments in the dozens of millions, it would be challenging to wire suchamounts through the legacy banking system without getting caught.
Additionally, it can be di cult even to wire the money in the rst place because
most of the top ransomware groups operate in high-risk jurisdictions that havetenuous ties with nancial systems in Europe and North America.
Lazarus Group, a proli c, North Korea-backed hacking group, has been using
Chinese or Malaysian bank accounts to sidestep sanctions. Still, that maneuver
would likely only work for smaller amounts rather than upwards of $40 million.
However, with Bitcoin, the amount of money these groups can receive
immediately is vastly larger than ransom payments of $100,000 or less becauseof the decentralized nature of the network. It is unsurprising, then, thatransomware groups have turned to cryptocurrencies.
Despite the wide variety of cryptocurrency options available, such as USDC,Ethereum, or even Monero, ransomware groups have relied on Bitcoin forreceiving ransom payments. This choice is likely because Bitcoin is the mostwell-known and easily accessible cryptocurrency for targeted users andorganizations.

fiffi

fifi

15

TRACING PAYMENTS
IS CRYPTOCURRENCYANONYMOUS AND
UNTRACEABLE?
There is now a fast-growing industry of companies that specialize in nding
criminals using on-chain data and other techniques, such as Chainalysis, TRM
Labs, and Elliptic. Finding criminals is possible because on the Bitcoin network,it’s possible to view all addresses that the ransomware recipient address has
ever interacted with and potentially trace that chain to the real owner. Everyone
leaves a digital trace online.
Clustering is an important technique that aids in unmasking criminals. It works
by analyzing Bitcoin blockchain data to nd links between addresses and merge
them into a group likely to be controlled by the same person or entity.
After the whole blockchain is analyzed, connections appear between the clusterof illicit actors and clusters of services, exchanges, other illicit actors, andpersonal wallets. This information can then be used to assist in further
investigative activities.

fifi

16

CASHING OUT
HOW?
Ransomware groups sometimes use
centralized exchanges to convert
cryptocurrency into at funds. To
avoid being caught, they create
accounts with fake government IDs
purchased on the dark web, but there
are pitfalls with that approach
discussed below. These groups mightalso use the crypto directly to buy
goods and services like watches, cars,servers, etc.
However, most professionalransomware groups are located in
hard-to-reach jurisdictions like Iran,
Russia, and North Korea, so they haveunique methods of cashing out. For
example, ransomware gangs from
North Korea are linked to thegovernment and rely on thoseconnections to cash out money
through Chinese exchanges. In
Russia, it is also possible to cash out
dirty money by using the OFACsanctioned exchange, Garantex.io, ora lot of other “private” exchanges,
which do not care about the source offunds.

USING EXCHANGESA BREAKTHROUGH FOR
TRACING BACKCRIMINALS?
Cybercriminals swap stolen crypto
from one blockchain to another, butthey are often not cautious enoughand use addresses that can lead totheir real identities. But mostsuccessful investigative cases rely on
obtaining information from
centralized exchanges. Even whencybercriminals use fake identities onexchanges, they still leave behindclues, such as IP addresses, bankaccounts, etc.
As a practical example of how
ransomware groups operate, inOctober 2021, DarkSide moved its
Bitcoin funds from one of its wallets
in what appeared to be the beginningof a money laundering operation. Thegroup split $6.8 million into seven
separate Bitcoin wallets. This tactic
made it more di cult to trace thegroup as it tried to convert thecryptocurrency into at. Small
amounts were then transferred toexchanges.

fifi

ffi

17

AVOIDING DETECTION
WHAT ARE THE
STANDARDTECHNIQUES?
To ght back against traceability, ransomware groups have used obfuscation
techniques to increase anonymity and avoid detection.

• Ransomware groups frequently use mixers or tumblers to obscure thedestination of their illicit Bitcoin ransom gains.

• Ransomware code is sometimes written in the style of another group to throw
investigators o the trail.

• Additionally, the operational security of these groups is very complex. Theyuse operating systems built for security, such as Linux Tails, and have several
layers of network connections to obscure their origin, such as VPN->VPN>Dedicated server->TOR network->Dedicated server.

• Most importantly, they use their place of operations as a security layer: Iran,Russia, and the DPRK are all jurisdictions that do not cooperate with foreign
subpoenas.

fffi18ORGANIZATIONPROTECTION
WHAT MEASURES TO
IMPLEMENT?
Big companies and organizations will always be targets because of their size.
However, there are several measures they can take to ensure being targeted
doesn’t turn into a disastrous ransomware attack.

• First, all organizations should have extensive and regular backups of crucial

information, as well as a recovery plan for restoring the data after an attack.

• Second, companies should keep systems and applications up to date to avoid
exploitation.

• Third, companies should provide training on common phishing attack vectors
and why it’s important not to open suspicious email attachments.

• Fourth, companies should use an intrusion detection system and antivirus
software.

CDProjekt Red, a videogame development rm based in Poland, is an example
of a company that successfully used backups to avoid paying a ransom. InFebruary 2021, the HelloKitty gang hacked the rm. While the groupsuccessfully stole the source code of game projects in development andencrypted devices, CDProjekt did not pay the ransom because it had backups torestore the lost data.

fifi

19

ImmuneImmune is the leading bug bounty and security services platform for web3
protecting over $60 billion in user funds. Immune features a massive
community of whitehat hackers who review projects’ blockchain and smart
contract code, nd and responsibly disclose vulnerabilities, and get paid formaking crypto safer. With Immune , whitehat hackers are rewarded based on
the severity of the vulnerability that they discover, creating incentives for as
many experts as possible to examine project code for vulnerabilities.
Immune has pioneered the scaling web3 bug bounties standard, meaning thatrewards should be priced accordingly with the severity of an exploit and thevolume of funds at risk, which resulted in the company building the largest
community of security talent in the web3 space.

Total bounties paid
Immune has paid out over $65 million in total bounties, while saving over
$25 billion in user funds.

Total bounties available
Immune o ers over $144 million in available bounty rewards.

Supported projects
Trusted by established, multi-billion dollar projects like Chainlink, Wormhole,MakerDAO, Compound, Synthetix, and more, Immune now supports 301
projects across multiple crypto sectors.

Largest bug bounty payments in the history of software

fi

fi

fi

fi

f

ff

fi

fi

fi

fi

fi

Immune has facilitated the largest bug bounty payments in the history ofsoftware.
$10 million for a vulnerability discovered in Wormhole, a generic cross-chain
messaging protocol.
$6 million for a vulnerability discovered in Aurora, a bridge and a scaling
solution for Ethereum.
$2.2 million for a vulnerability discovered in Polygon, a decentralised Ethereum
scaling platform that enables developers to build scalable user-friendly dApps.

The full data sources are available below.
1. CNA Financial
2. JBS
3. CWT
4. Brenntag
5. Colonial Pipeline
6. Travelex
7. UCSF
8. BRB Bank
9. Jackson County, Georgia
10.University of Maastricht

If you’re a developer thinking about a bug-hunting career in web3, we gotyou. Check out our Web3 Security Library, and start taking home some of
the $144M in rewards available on Immune — the leading bug bounty
platform for web3.

fifi

https://immune .com/