• XRATOR
  • Our Experts
  • Contact Us
  • Privacy & Policy
Conquer your risk
  • Home
  • Articles
  • News
  • Research
  • State of the art
No Result
View All Result
  • Home
  • Articles
  • News
  • Research
  • State of the art
No Result
View All Result
Conquer your risk
No Result
View All Result
Home Cybercrime

How the Dutch police scammed the Deadbolt ransomware gang

Police in the Netherlands seized 155 decryption keys from the DeadBolt group after paying ransoms, which were subsequently invalidated.

Gwendal SmithbyGwendal Smith
November 18, 2022
in Cyber Attacks, Cybercrime, Malware, News
0
Police in the Netherlands seized 155 decryption keys from the DeadBolt group after paying ransoms, which were subsequently invalidated.

The Dutch police recently recovered 155 decryption keys from victims of the DeadBolt ransomware gang, revealing the hackers’ creativity while also illustrating the creativity of those fighting organized crime. Deadbolt is active since january 2022. It is mainly targeting SMB by encrypting their Network Access Storage.

A Smart Payment trickery

The Dutch police and cybersecurity firm Responders recently came up with a simple hack to obtain the decryption keys from DeadBolt. In order to obtain these keys, the Dutch investigators have been tricky. Responders shared the hack which is quite simple. To put it simply, the police simply paid bitcoin ransoms in order to obtain the victims’ decryption keys.

Once the ransom was paid, DeadBolt automatically generated a new bitcoin transaction containing the victim’s decryption key. The police and Responders identified this as a weakness and exploited the automatic process. They targeted a congestion phase of the Bitcoin blockchain to initiate transactions. They  then cancelled the transactions. It prevents setting those in the blockchain stone.

In this way, they obtained one hundred and fifty-five decryption keys. The DeadBolt gang then realized the scam and set up a double confirmation mechanism before sending the decryption keys.

Decryption keys freely available for the victims

Europol, the French police, and the gendarmerie assisted the Dutch police. The nature of that assistance was not disclosed. Victims who have yet to come forward can now use a page on the Responders website to recover decryption keys that police may have seized.

Dutch police estimate that the DeadBolt ransomware has infected more than 20,000 victims globally since January 2022. The ransomware locked victims’ files and demanded a ransom of 0.03 bitcoin, or about 600 euros today. Qnap network storage servers and Asustor devices were targeted by the DeadBolt gang.

Tags: BlockchainLaw Enforcementransomware

Categories

  • Cybercrime
  • Malware
  • Vulnerability & Weakness
  • Threat Intelligence
  • Cyber Attacks
  • Cybersecurity
  • Offensive Security
  • Risk Management
  • Cyberdefense
  • Cyber Insurance

Popular News

  • The H-Factor: Turning Human Into The Strongest Link Of Your Cybersecurity Strategy

    The H-Factor: Turning Human Into The Strongest Link Of Your Cybersecurity Strategy

    0 shares
    Share 0 Tweet 0
  • Understanding and Mitigating the Risk of Computer Memory Exploitation

    0 shares
    Share 0 Tweet 0
  • Three Social Impacts of Ransomware Operations

    0 shares
    Share 0 Tweet 0
  • Methods to Conduct an Insider Threat Risk Assessment

    0 shares
    Share 0 Tweet 0
  • Why Lockbit does fake cyberattacks ?

    0 shares
    Share 0 Tweet 0

"Conquer Your Risk" is a corporate blog for Cybersecurity and Risk Management executives and specialists, sharing XRATOR experts' views on Cybersecurity, Threat Intelligence, Risk Management and Cyber Insurance.

Categories

  • Articles
  • Cyber Attacks
  • Cyber Insurance
  • Cybercrime
  • Cyberdefense
  • Cybersecurity
  • Malware
  • News
  • Offensive Security
  • Research
  • Risk Management
  • Scams
  • State of the art
  • Threat Intelligence
  • Vulnerability & Weakness

Quick Links

  • XRATOR
  • Our Experts
  • Privacy Policy
  • Contact Us

XRATOR® – copyright 2020-2021

No Result
View All Result
  • Contact Us
  • Homepages

© 2018 JNews by Jegtheme.

Manage Cookie Consent
We use cookies to optimize our website and our service.
By closing this windows, you automatically deny non-functionals cookies.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Manage options Manage services Manage vendors Read more about these purposes
Preferences
{title} {title} {title}
Manage Cookie Consent
We use cookies to optimize our website and our service.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Manage options Manage services Manage vendors Read more about these purposes
Preferences
{title} {title} {title}