Essays, Posts & Presentations

Sleuthing DarkSide Crypto-Ransom Payments with the Wolfram Language

Dariia Porechna

Author

Dariia Porechna

Title

Sleuthing DarkSide Crypto-Ransom Payments with the Wolfram Language

Description

Tracing Russian hackers' cryptocurrency funds using only public knowledge, some educated guesses and blockchain integration in the Wolfram Language.

Sleuthing DarkSide Crypto-Ransom Payments with the Wolfram Language

May 25, 2021

Dariia Porechna, Cryptography and Blockchain, Wolfram Language Development

Let me tell you a story about how to trace Russian hackers’ cryptocurrency funds using only public knowledge, some educated guesses and the Wolfram Language.

But first, a little background information.

On May 7, 2021, Colonial Pipeline was the victim of a ransomware attack, which forced the largest fuel pipeline in the US to shut down its operations. The next day, the FBI confirmed the Russian hacker group DarkSide was responsible. At almost the same time, German chemical distribution company Brenntag was the victim of a separate DarkSide ransomware attack.

On May 12, Colonial Pipeline resumed operations, and the next day DarkSide announced it was disbanding and would compensate all outstanding financial obligations by May 23. Reports also emerged that Colonial Pipeline and Brenntag had paid substantial bitcoin ransoms.

To see what we can learn about all this, we first need to synchronize our watches and blockchains:

In[]:=

$TimeZone=0;$BlockchainBase="Bitcoin";CloudConnect[];

Some news outlets said they obtained information from the victims and identified the wallets that payments were sent to, but didn’t disclose which ones. All transactions on Bitcoin are public, so I decided to look for myself and put our blockchain integrations to the test. Bitcoin has, however, hundreds of thousands of daily transactions, and I needed something solid to look for.

From widely shared reports, I knew Colonial Pipeline paid 75 bitcoins (BTC) in ransom at some point on May 8, and Brenntag paid 78.29 BTC on May 11 to the same group of hackers. News reports usually speak with respect to their local time zone, and information systems, like blockchains, with respect to Coordinated Universal Time (UTC). I wasn’t sure how large a window of transactions I should scan for Colonial Pipeline’s payment on May 7–9 to cover the whole day of May 8 in all time zones from the United States’s East Coast to eastern Europe.

On the other hand, Brenntag is in Germany, which is the same time zone I live in, and close to UTC. The 78.29 BTC paid also looked like a more definitive pattern to search for, so I decided to investigate that clue first.

As a starting point, I took a random block mined a couple of hours after midnight on May 12 and started iterating backward, looking for transactions with an input amount larger than 78 BTC. Being such a big sum, there were only a handful per block and sometimes none.

(Why look for larger transactions and not exactly equal ones? Just as with cash banknotes, it’s common for transactions to have a bigger input value than the actual amount and then return the difference.)

I planned initially to generate a list of all suspiciously large transactions on that day and analyze them one by one. But luckily I didn’t have to because the scan quickly came across a transaction of exactly 78.29 BTC:

In[]:=

currentblock=683175;blocktxs=ParallelMap[{#,BlockchainTransactionData[#,"TotalInput"]}&,BlockchainBlockData[currentblock,"TransactionList"]];Selectblocktxs,Last[#]>

฿

&

Out[]=

b5174dfd8fc409fd8576b59ba49983b49da2294a5975ef8f9dfea7c1fee0a65f,

฿

78.29

,4b2bb27c9ab3244b7d55cda9d8c859b5a6d8d19422bf21d34b54c1771335a2e5,

฿

99.3248

,3a13379980666c7e8639055cef1fd5706b257e0f5747c6a431d952393270275d,

฿

99.963



Right away, I checked at what time the block the transaction was in was mined:

In[]:=

BlockchainBlockData[683175,"TimeMined"]

Out[]=

Tue 11 May 2021 22:24:11GMT

The block was mined, which effectively performed the transfer, at 22:24 GMT on May 11. Could it be the deadline the hackers gave was midnight? We may never know.

Following the Bitcoin Tracks This transaction had the exact amount I was looking for as input:

In[]:=

First[BlockchainTransactionData["b5174dfd8fc409fd8576b59ba49983b49da2294a5975ef8f9dfea7c1fee0a65f","Inputs"]]

Out[]=

TransactionID7485dc123d3fb24e9965abb765744c5682e20d66cf630531191eb8e5681b42fb,Index0,Amount

฿

78.29

,ScriptByteArray{},ScriptString,SequenceNumber4294967295,Addresses{bc1qk568sufppx2h0w4hxdkqctq65erjsy5mg2267g},SourceConfirmations1057

The address the funds were transferred from was:

In[]:=

First[%["Addresses"]]

Out[]=

bc1qk568sufppx2h0w4hxdkqctq65erjsy5mg2267g

Let’s see what we can learn from public information about this address:

In[]:=

BlockchainAddressData[%]

Out[]=

Addressbc1qk568sufppx2h0w4hxdkqctq65erjsy5mg2267g,Balance

฿

,ValueInUSDollars

0.00

,TotalTransactions2,TransactionListTransactionIDb5174dfd8fc409fd8576b59ba49983b49da2294a5975ef8f9dfea7c1fee0a65f,BlockNumber683175,Timestamp

Tue 11 May 2021 22:24:11GMT

,InputsAddresses{bc1qk568sufppx2h0w4hxdkqctq65erjsy5mg2267g},Amount

฿

78.29

,OutputsAddresses{bc1qxu83k5qkj8kcqdqqenwzn7khcw4llfykeqwg45},Amount

฿

66.5465

,Addresses{bc1qqklq840yf39zdm4kvcvjfwrxdm27fxtxe37sjj},Amount

฿

11.7433

,TransactionID7485dc123d3fb24e9965abb765744c5682e20d66cf630531191eb8e5681b42fb,BlockNumber683172,Timestamp

Tue 11 May 2021 22:04:55GMT

,InputsAddresses{bc1q4y7x6663a5rtcsa8lqs8jwu07kfvukknvppup7},Amount

฿

0.148694

,Addresses{bc1q4y7x6663a5rtcsa8lqs8jwu07kfvukknvppup7},Amount

฿

78.4994

,OutputsAddresses{bc1qk568sufppx2h0w4hxdkqctq65erjsy5mg2267g},Amount

฿

78.29

,Addresses{bc1q4y7x6663a5rtcsa8lqs8jwu07kfvukknvppup7},Amount

฿

0.357295



The balance on this address is zero and the total transaction count is two, which means the address was only used as a temporary relay for receiving the ransom payment and transferring it somewhere else. Single-use addresses are a common practice, so nothing is suspicious about this particular detail.

The first transaction received the 78.29 BTC payment from Brenntag at 22:04 on May 11, tracing back to the Binance exchange. The second and last transaction 20 minutes later showed the bitcoins were split between two new addresses:

In[]:=

%[["TransactionList",1,"Outputs"]]

Out[]=

Addresses{bc1qxu83k5qkj8kcqdqqenwzn7khcw4llfykeqwg45},Amount

฿

66.5465

,Addresses{bc1qqklq840yf39zdm4kvcvjfwrxdm27fxtxe37sjj},Amount

฿

11.7433



No surprise… those were now empty too:

In[]:=

BlockchainAddressData["bc1qxu83k5qkj8kcqdqqenwzn7khcw4llfykeqwg45","Balance"]

Out[]=

฿

In[]:=

BlockchainAddressData["bc1qqklq840yf39zdm4kvcvjfwrxdm27fxtxe37sjj","Balance"]

Out[]=

฿

Then a transaction in one of the two addresses caught my eye:

In[]:=

Last[BlockchainAddressData["bc1qxu83k5qkj8kcqdqqenwzn7khcw4llfykeqwg45","TransactionList"]]

Out[]=

TransactionID0677781a5079eae8e5cbd5e6d9dcc5c02da45351a3638b85c88e5e3ecdc105a7,BlockNumber682606,Timestamp

Sat 8 May 2021 18:21:49GMT

,InputsAddresses{bc1q7eqww9dmm9p48hx5yz5gcvmncu65w43wfytpsf},Amount

฿

0.00001693

,Addresses{bc1q7eqww9dmm9p48hx5yz5gcvmncu65w43wfytpsf},Amount

฿

75.

,OutputsAddresses{bc1qxu83k5qkj8kcqdqqenwzn7khcw4llfykeqwg45},Amount

฿

63.75

,Addresses{bc1qu57hnxf0c65fsdd5kewcsfeag6sljgfhz99zwt},Amount

฿

11.2496



It received part of the 75 BTC payment on May 8, which matched the Colonial Pipeline payment and can be traced back to the Coinbase exchange:

In[]:=

BlockchainTransactionData[%["TransactionID"],{"TotalInput","Timestamp"}]

Out[]=



฿

75.

Sat 8 May 2021 18:21:49GMT



The latest transaction listed on the same address emptied it and several other addresses on May 13, the day DarkSide announced it was ceasing operations:

In[]:=

First[BlockchainAddressData["bc1qxu83k5qkj8kcqdqqenwzn7khcw4llfykeqwg45","TransactionList"]]

Out[]=

TransactionIDb0e381d02d966acbcd9224817e3db50b2bc3566e0060db36a6a17ee163152dd7,BlockNumber683474,Timestamp

Thu 13 May 2021 18:03:26GMT

,InputsAddresses{bc1q6zy0fkaglv0keyajzl307vntl6nd8ypwepgsce},Amount

฿

0.0253571

,Addresses{bc1q6l5fxnua9m9harcwm3gdqkh28van0vjznq6sss},Amount

฿

0.00293188

,Addresses{bc1qyqzm47j74c9geurltqw2r4cchfgy47sd2df8qp},Amount

฿

1.11177

,Addresses{bc1q92aqauj5en8ykz5tu5fz7aya5u809q4m59pqcl},Amount

฿

0.007975

,Addresses{bc1qhxmpp6lyzy4zl3aky7v56prd857aa8wl8f2c5j},Amount

฿

0.00719504

,Addresses{bc1qnakarptljy2u67zaxuef4hq6uj08ll5c57lgtr},Amount

฿

0.00011042

,Addresses{bc1qvjwzz5k2t46z509ydyru2sk33xlf0jj0ydxz56},Amount

฿

0.007975

,Addresses{bc1qkhn9wt553043rqs0nfnwkv5gp8tqsvnylkvytn},Amount

฿

0.0015098

,Addresses{bc1qazr2rl8lh3zkm3x7kzntywty2pc4lk8mk2rdzj},Amount

฿

0.0130093

,Addresses{bc1qza5ccvrwtmlkqugdr9hej32r45maqr8zsex86u},Amount

฿

17.

,Addresses{bc1q269jv9es4g3ah8zkt0m4q8f9a2ln0qsd8pt29w},Amount

฿

0.00067672

,Addresses{bc1qxu83k5qkj8kcqdqqenwzn7khcw4llfykeqwg45},Amount

฿

66.5465

,Addresses{bc1q8e086ts03a7ssmzjqvalmffjyae2d4z7xdf7kd},Amount

฿

0.00268162

,Addresses{bc1q92aqauj5en8ykz5tu5fz7aya5u809q4m59pqcl},Amount

฿

0.00162136

,Addresses{bc1qv7k53ftat6nyvgqvpahym9c0sf9sj6yjv8r7zc},Amount

฿

0.00913072

,Addresses{bc1qk5684nmwyyfc37l0fdrjan6nk87y3ehnz04485},Amount

฿

0.00025

,Addresses{bc1qmug4q23872hpmct4pdzlqk20khadfj9xq75cms},Amount

฿

0.00884416

,Addresses{bc1q4l3m0uaw7554a9hm0w9wlg60yxfda5zu38m938},Amount

฿

0.00172136

,Addresses{bc1qxu83k5qkj8kcqdqqenwzn7khcw4llfykeqwg45},Amount

฿

0.0497663

,Addresses{bc1qqklq840yf39zdm4kvcvjfwrxdm27fxtxe37sjj},Amount

฿

11.7433

,Addresses{bc1qly789z4wff63g2dku46ucxrke0z60chayehqzm},Amount

฿

0.0053937

,Addresses{bc1qr2jur6vfp3w5pk37pzdvxajptp4cyajs3qkwnm},Amount

฿

0.00046078

,Addresses{bc1qu57hnxf0c65fsdd5kewcsfeag6sljgfhz99zwt},Amount

฿

11.2496

,Addresses{bc1qqyp9lywhsllc4yay6gchsx9eleymg4et7a8a2w},Amount

฿

0.00293446

,OutputsAddresses{bc1q2sewgrnau4e4gvceh8ykzf8lqxawpluu0k0607},Amount

฿

107.8



The output address still had the 107.8 BTC, currently worth $4.5 million USD, on it:

In[]:=

BlockchainAddressData["bc1q2sewgrnau4e4gvceh8ykzf8lqxawpluu0k0607",{"Balance","ValueInUSDollars"}]

Out[]=



฿

107.82

4.58826×



Of course, 75 and 78 do not add up to 107, so some of the bitcoins were likely paid to people who provided information about victims’ system vulnerabilities, and some were cashed out in smaller amounts.

The Cluster of Addresses DarkSide Used The transaction that hoarded 107.8 BTC to a single address has quite a few senders:

In[]:=

BlockchainTransactionData["b0e381d02d966acbcd9224817e3db50b2bc3566e0060db36a6a17ee163152dd7","Inputs"]//Length

Out[]=

It’s generally easier for me to digest information visually. Here’s how the transaction is represented as a graph of all those senders combining their funds at a single address:

Contents cannot be rendered at this time; please try again later or download this notebook for full functionality »

The top layer of vertices is the “spending” addresses, a square vertex in the middle symbolizes the transaction that unites them and the vertex at the bottom is the receiving address. Red and green arrows symbolize a negative or positive change in the address’s balance.

The receiver address bc1q2sewgrnau4e4gvceh8ykzf8lqxawpluu0k0607 was only active for a few minutes on May 13 with these three transactions:

In[]:=

BlockchainAddressData["bc1q2sewgrnau4e4gvceh8ykzf8lqxawpluu0k0607","TransactionList"][[All,"Timestamp"]]

Out[]=



Thu 13 May 2021 18:03:26GMT

Thu 13 May 2021 17:55:18GMT



Let’s visualize them together:

Contents cannot be rendered at this time; please try again later or download this notebook for full functionality »

This address has only three transactions, but they come from three dozen different senders:

{bc1qnqqwtrdsfp8h652awas8429ay3wzm6m55n6snn,bc1qr2jur6vfp3w5pk37pzdvxajptp4cyajs3qkwnm,bc1qy3lhen8y09ut9w0mmrs7gzcg5gzdykgnt6yj2h,bc1qslhjxepcevcas5lzxmw7p8hdmajp38ghqwnz9v,bc1q6zy0fkaglv0keyajzl307vntl6nd8ypwepgsce,bc1q6l5fxnua9m9harcwm3gdqkh28van0vjznq6sss,bc1qyqzm47j74c9geurltqw2r4cchfgy47sd2df8qp,bc1q92aqauj5en8ykz5tu5fz7aya5u809q4m59pqcl,bc1qhxmpp6lyzy4zl3aky7v56prd857aa8wl8f2c5j,bc1qnakarptljy2u67zaxuef4hq6uj08ll5c57lgtr,bc1qvjwzz5k2t46z509ydyru2sk33xlf0jj0ydxz56,bc1qkhn9wt553043rqs0nfnwkv5gp8tqsvnylkvytn,bc1qazr2rl8lh3zkm3x7kzntywty2pc4lk8mk2rdzj,bc1qza5ccvrwtmlkqugdr9hej32r45maqr8zsex86u,bc1q269jv9es4g3ah8zkt0m4q8f9a2ln0qsd8pt29w,bc1qxu83k5qkj8kcqdqqenwzn7khcw4llfykeqwg45,bc1q8e086ts03a7ssmzjqvalmffjyae2d4z7xdf7kd,bc1qv7k53ftat6nyvgqvpahym9c0sf9sj6yjv8r7zc,bc1qk5684nmwyyfc37l0fdrjan6nk87y3ehnz04485,bc1qmug4q23872hpmct4pdzlqk20khadfj9xq75cms,bc1q4l3m0uaw7554a9hm0w9wlg60yxfda5zu38m938,bc1qqklq840yf39zdm4kvcvjfwrxdm27fxtxe37sjj,bc1qly789z4wff63g2dku46ucxrke0z60chayehqzm,bc1qu57hnxf0c65fsdd5kewcsfeag6sljgfhz99zwt,bc1qqyp9lywhsllc4yay6gchsx9eleymg4et7a8a2w,bc1qp7d6kwzlheuc38rtd3j9w0adhh3k63g9x3r7r8,bc1q50t6axslwn23xzz3mxdgajl9trjrta6pr78fjj}

It’s not known whether the receiving address belongs to DarkSide, but most of these 27 addresses that have sent this combined $5 million transferred to it do.

In[]:=

Length[%]

Out[]=

Both the Colonial Pipeline and Brenntag ransom payments were made to these addresses, and they all signed this joint transaction.

At least, these addresses did belong to DarkSide. Both payments that we know of were split among several other addresses and then reunited multiple times. The creation of addresses and the divide-and-conquer transfers were probably done automatically to randomize DarkSide’s tracks and make piecing the puzzle together more difficult.

All the addresses had been active only since March and the last transactions were on May 13:

Contents cannot be rendered at this time; please try again later or download this notebook for full functionality »

In this time period, the addresses received multiple transactions in varying amounts:

addressTotalIncome/@cluster



฿

1.42671

฿

63.016

฿

4.496

฿

8.57179

฿

8.176

฿

1.12334

฿

1.11177

฿

0.00959636

฿

1.3276

฿

12.072

฿

0.007975

฿

0.931742

฿

3.01759

฿

17.

฿

5.71468

฿

130.296

฿

5.09346

฿

7.70926

฿

0.00025

฿

10.6598

฿

0.00172136

฿

11.7433

฿

0.875628

฿

11.2496

฿

3.17334

฿

56.448

฿

5.5398



These transactions total an impressive 370 BTC, which is over $13 million USD:

In[]:=

Total[%]

Out[]=

฿

370.793

This suggests that there were other DarkSide ransomware victims who didn’t get into the media spotlight or who preferred to keep their ransom events secret.

The Bigger Picture Let’s go a step further to see “who paid the payer.” This graph takes all 27 previous “sender” addresses and traces funds a layer back: the transactions that have sent bitcoins to these addresses. Most of the transactions merely split a payment between two addresses in the 27-cluster, showing again how interwoven they are:

Contents cannot be rendered at this time; please try again later or download this notebook for full functionality »

On the right, we can see the splits of the infamous 78.29 and 75 BTC payments by ransom victims Brenntag and Colonial Pipeline. In the structure of our graph, there are also more transactions that follow the same pattern, adding up to the 370 BTC computed earlier.

If we plot the outgoing transactions from the cluster, we see many more addresses to which parts of ransom payments were sent:

Contents cannot be rendered at this time; please try again later or download this notebook for full functionality »

Most of them were sent on May 13, when the group disbanded:

May 8 has a notable bump, likely meaning hackers paid some dues for the work and cashed out some of the gains after the Colonial Pipeline payment. Some of those can be traced to exchanges big and small, centralized and peer to peer. Others have finished in people’s wallets.

A Final Note These are the highlights of my findings, and there’s surely much more left to discover, so feel free to interact with the code embedded in this article and share your findings too.

On a personal note, it’s an empowering feeling to have all the right tools in the Wolfram Language at hand to embark on a cyber-investigative computational journalism adventure. Even more so, it’s great being a part of Wolfram Blockchain Labs, which develops the blockchain integration and analytics for the Wolfram technology ecosystem.

We’ll continue to sharpen our tools to be ready whenever needed. Just like this time… and the inevitable next time.

Cite this as: Dariia Porechna, "Sleuthing DarkSide Crypto-Ransom Payments with the Wolfram Language" from the Notebook Archive (2022), https://notebookarchive.org/2022-01-97ylarb