The US Department of Justice (DoJ) has announced a campaign to disrupt the activities of the BlackCat ransomware group responsible for the cyberattack on MGM Resorts.
The strategy involves the implementation of a decryption tool developed by the FBI to restore hacked systems, alongside cooperation with international law enforcement bodies and a campaign to seize control of the BlackCat computer systems and sites.
“In disrupting the BlackCat ransomware group, the Justice Department has once again hacked the hackers,” said deputy attorney general Lisa O. Monaco.
Monaco also highlighted the successful rollout of the FBI’s tool and committed the DoJ to continued action against the hackers.
Sometimes going by the name ALPHV, in September the group caused chaos at MGM properties in a major breach that compromised operations including hotel room access, slot machines and booking systems.
In the aftermath of the attack, MGM said it expected the incident to result in a $100m hit to EBITDA.
While MGM’s Las Vegas Strip rival Caesars Entertainment also had systems compromised by the group, it found itself less affected after it paid a substantial portion of the hacker’s ransom.
In a search warrant unsealed today in the Southern District of Florida, the FBI claimed they had accessed the BlackCat group’s computer network as part of the investigation and seized several websites operated by the hackers.
The warrant also details the global nature of the hacker’s activities, which includes compromising government, defence sector and emergency services systems.
The interagency work has seen the campaign collaborate with law enforcement bodies worldwide including Germany’s Bundeskriminalamt, the UK’s National Crime Agency, the US Secret Service and Europol.
“The FBI continues to be unrelenting in bringing cybercriminals to justice and determined in its efforts to defeat and disrupt ransomware campaigns targeting critical infrastructure, the private sector, and beyond,” said FBI deputy director Paul Abbate.
SEC updates cyberattack disclosure rules
This week also saw the SEC’s new rules for cyberattack disclosure go into effect.
Announced in July, companies are now required to disclosure material cybersecurity incidents, as well as provide an annual report on their risk management, strategy, and governance in this area.
First announced by the financial regulator in July, the SEC said foreign private issuers would also be expected to make similar disclosures.
“Whether a company loses a factory in a fire — or millions of files in a cybersecurity incident — it may be material to investors,” said SEC chair Gary Gensler.
“Currently, many public companies provide cybersecurity disclosure to investors. I think companies and investors alike, however, would benefit if this disclosure were made in a more consistent, comparable, and decision-useful way.
“Through helping to ensure that companies disclose material cybersecurity information, today’s rules will benefit investors, companies, and the markets connecting them.”
