74% of ransomware revenues go to hacker groups in Russia

According to a study published by Chainalysis, up to 74% of the proceeds from blackmailing ransomware victims went in 2021 to groups of hackers associated in one way or another with Russia.

Following the thread of blockchain transactions and the clues revealed by the association of those wallets of cryptocurrencies with hackers who are either clearly Russian-speaking, being assigned communications or malware code with additions in Russian, or frequenting Russian-specific forums, researchers Chainalysis was able to identify payments of at least $ 400 million that went to criminal groups affiliated with Russia. Predictably, the authorities in this country have denied all allegations of hosting or supporting groups of hackers.

According to Chainalysis investigations, the cash flow could be tracked to and from the digital wallets of well-known hacking groups, using public records of blockchain transactions.

Analysts say they know exactly which hacking groups are Russian, because they have various characteristics, for example:

The ransomware application code includes additional checks, which stop the attack if the infected device is located in Russia or in a CIS country (Commonwealth of Independent States, an organization created and supported by Russia)

Members of the groups work in Russian, accessing hacking forums frequented exclusively by Russian speakers

The gang is linked to Evil Corp – an alleged cyber-attack group under investigation by the United States

Chainalysis’s allegations only complement other investigations that have led to similar findings, namely that numerous cyber-attack groups operate either in Russia or in regions of the Commonwealth of Independent States (CIS) – an intergovernmental organization of former Soviet-speaking countries. Russian.

A major international operation against those groups specializing in ransomware attacks was launched in 2021.

Alleged members of the Russian-backed groups have been arrested in Romania, Ukraine, South Korea and Kuwait.