At the beginning of May, a U.S. pipeline company suffered a ransomware attack. The company halted operations for several days, causing a spike in gas prices and localized fuel shortages. It also decided to meet the threat actors’ demands of $5 million, an ask emblematic of the rising costs of ransomware.
The U.S. Department of Justice (DOJ) is taking action in the wake of that attack, among others. As reported by Reuters, DOJ investigators will now begin looking into ransomware attacks with the same level of priority as they do with terrorism.
Read on to learn how this decision might affect the DOJ’s investigations into ransomware going forward.
A ‘Specialized Process’
On June 3, 2021, Reuters reported internal guidance sent within the DOJ and among U.S. attorneys’ offices. A new task force in Washington will now be responsible for centrally coordinating information about ransomware investigations.
John Carlin, DOJ’s principal associate deputy attorney general, said the U.S. government will now tackle the ransomware threat more holistically.
“It’s a specialized process to ensure we track all ransomware cases regardless of where it may be referred in this country, so you can make the connections between actors and work your way up to disrupt the whole chain,” he said.
To do that, the DOJ will expect U.S. attorneys’ offices to share ransomware case details and other technical information with leaders in Washington on an ongoing basis.
U.S. attorney investigators will also look into other instances of digital crime, including botnets and online money laundering services.
“We’ve used this model around terrorism before, but never with ransomware,” Carlin pointed out.
Over 100 Ransomware Strains Under FBI Scrutiny
A day after Reuters’ report, FBI Director Christopher Wray provided an update into the Bureau’s anti-efforts. The FBI will approach the ransomware threat as it did the challenges posed by the 9/11 terrorist attacks, he said.
“There are a lot of parallels; there’s a lot of importance and a lot of focus by us on disruption and prevention,” Wray told The Wall Street Journal. “There’s a shared responsibility, not just across government agencies but across the private sector and even the average American.”
Wray went on to reveal that the FBI is currently tracking over 100 different ransomware strains. Many of those trace back to gangs in Russia, he clarified.
How to Defend Against a Ransomware Attack
The DOJ’s shift in approach highlights the need for businesses and agencies to consider this a serious threat. Towards this end, organizations can follow best practices laid out by The White House, such as testing their incident response plans often. Doing so will help them to find gaps in their defenses.
Organizations should also consider segmenting their networks. This measure is essential for preventing an infection from affecting enterprise assets more widely. With network segmentation, data backup can be used to restore the affected segment — all while preserving at least some of their business functions.
If you have experienced a ransomware attack and would like immediate assistance from IBM Security X-Force incident response, please call our hotline at 1-888-241-9812 (US) or +001-312-212-8034 (Global). Learn more about X-Force’s threat intelligence and incident response services.