More frequent disruption operations needed to dent ransomware gangs, officials say

The comments from White House and ODNI officials ahead of a Counter Ransomware Initiative summit come as the gangs prove difficult to keep down.

With ransomware gangs proving capable of quickly reconstituting after government takedown operations, an international alliance wants to ramp up those offensive measures even more.

“What we’ve observed is that there is no one operation that’s going to disrupt ransomware permanently,” Anne Neuberger, deputy national security advisor for cyber and emerging technology, told reporters in a call Monday. “Instead, we have to increase the frequency and increase the breadth of these operations, by taking down infrastructure regularly, designating the exchanges that are facilitating money laundering and ransomware activity regularly.”

Neuberger’s comments previewed meetings this week of the Counter Ransomware Initiative, a U.S.-created organization now composed of 68 countries. The summit’s first two days will focus on disruption operations and policy, Neuberger said. A third day will focus on the nexus of artificial intelligence and cyber defense, with presentations from government agencies and leading AI companies.

The initiative plans to roll out a counter-ransomware fund that USAID will lead, supported by member nations and the private sector; guidance to aid victims of ransomware attacks produced by member nations and supported by insurance bodies; a Canadian private sector advisory panel meant to foster information sharing; an Australian-developed website through which member countries can seek help with ransomware attacks; and the expansion of a cybersecurity supply chain effort for the energy sector from the G7 to the initiative’s member nations.

As long as victims keep paying ransoms, though, there’s always going to be a big incentive for gangs to stay in business, Neuberger said. That in turn drives the need to increase the number of operations against those gangs, she said. A task force within the initiative “drives more and more disruption activity and more countries joining it to try to improve the impact.”

Laura Galante, director of the Cyber Threat Intelligence Integration Center (CTIIC) housed within the Office of the Director of National Intelligence, said it counted 2,593 attacks in 2022, 4,506 in 2023 and 2,321 attacks through the first half of this year.

“What this looks like to us is, we’ve seen a real jump in the number of attacks and proliferation of the type of infrastructure and tools that a variety of ransomware actors have been able to use,” she said. “They have incredibly decentralized models that allow for rebranding and reconstituting even after they’ve been disrupted.”

Still, Galante said, disruption operations have “been really key to making this harder for certain groups to really get deeper and more specialized and mature, and makes the organizations a little bit more chaotic, which ends up being helpful, because it takes more time for them to reconstitute and have successful operations in the future.”

Disruption operations appear to have weakened ALPHV/Black Cat, for example, she said.

The newest members of the initiative are Argentina, Bahrain, Cameroon, Chad, Morocco, Hungary, the Philippines, Slovenia, Vanuatu and Vietnam.

Government

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

Technology

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems