August 17, 2021 By David Bisson 2 min read

At the beginning of May, a U.S. pipeline company suffered a ransomware attack. The company halted operations for several days, causing a spike in gas prices and localized fuel shortages. It also decided to meet the threat actors’ demands of $5 million, an ask emblematic of the rising costs of ransomware.

The U.S. Department of Justice (DOJ) is taking action in the wake of that attack, among others. As reported by Reuters, DOJ investigators will now begin looking into ransomware attacks with the same level of priority as they do with terrorism.

Read on to learn how this decision might affect the DOJ’s investigations into ransomware going forward.

A ‘Specialized Process’

On June 3, 2021, Reuters reported internal guidance sent within the DOJ and among U.S. attorneys’ offices. A new task force in Washington will now be responsible for centrally coordinating information about ransomware investigations.

John Carlin, DOJ’s principal associate deputy attorney general, said the U.S. government will now tackle the ransomware threat more holistically.

“It’s a specialized process to ensure we track all ransomware cases regardless of where it may be referred in this country, so you can make the connections between actors and work your way up to disrupt the whole chain,” he said.

To do that, the DOJ will expect U.S. attorneys’ offices to share ransomware case details and other technical information with leaders in Washington on an ongoing basis.

U.S. attorney investigators will also look into other instances of digital crime, including botnets and online money laundering services.

“We’ve used this model around terrorism before, but never with ransomware,” Carlin pointed out.

Over 100 Ransomware Strains Under FBI Scrutiny

A day after Reuters’ report, FBI Director Christopher Wray provided an update into the Bureau’s anti-efforts. The FBI will approach the ransomware threat as it did the challenges posed by the 9/11 terrorist attacks, he said.

“There are a lot of parallels; there’s a lot of importance and a lot of focus by us on disruption and prevention,” Wray told The Wall Street Journal. “There’s a shared responsibility, not just across government agencies but across the private sector and even the average American.”

Wray went on to reveal that the FBI is currently tracking over 100 different ransomware strains. Many of those trace back to gangs in Russia, he clarified.

How to Defend Against a Ransomware Attack

The DOJ’s shift in approach highlights the need for businesses and agencies to consider this a serious threat. Towards this end, organizations can follow best practices laid out by The White House, such as testing their incident response plans often. Doing so will help them to find gaps in their defenses.

Organizations should also consider segmenting their networks. This measure is essential for preventing an infection from affecting enterprise assets more widely. With network segmentation, data backup can be used to restore the affected segment — all while preserving at least some of their business functions.

If you have experienced a ransomware attack and would like immediate assistance from IBM Security X-Force incident response, please call our hotline at 1-888-241-9812 (US) or +001-312-212-8034 (Global). Learn more about X-Force’s threat intelligence and incident response services.

More from News

CISA and FBI release secure by design alert on cross-site scripting 

3 min read - CISA and the FBI are increasingly focusing on proactive cybersecurity and cyber resilience measures. Conjointly, the agencies recently released a new Secure by Design alert aimed at eliminating cross-site Scripting (XSS) vulnerabilities, which have long been exploited to compromise both data and user trust. Cross-site scripting vulnerabilities occur when a web application improperly handles user input, allowing attackers to inject malicious scripts into web pages that are then executed by unsuspecting users. These vulnerabilities are dangerous because they don't attack…

Has BlackCat returned as Cicada3301? Maybe.

4 min read - In 2022, BlackCat ransomware (also known as ALPHV) was among the top malware types tracked by IBM X-Force. The following year, the threat actor group added new tools and tactics to enhance BlackCat's impact. The effort paid off — literally. In March 2024, BlackCat successfully compromised Change Healthcare and received a ransom payment of $22 million in Bitcoin. But here's where things get weird: Immediately after taking payment, BlackCat closed its doors, citing "the feds" as the reason for the…

Biden-⁠Harris administration releases roadmap to enhance internet routing

2 min read - The Biden-Harris Administration has taken another step toward improving the nation’s cybersecurity. In September, the White House Office of the National Cyber Director (ONCD) announced it was putting policies in place to address a key security vulnerability associated with the Border Gateway Protocol (BGP). BGP is a set of rules that helps the internet work by selecting the best route for data to travel between networks. It is a fundamental protocol that allows networks to communicate with each other. However,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today