Data Encrypted for Impact (T1486): Real Cases

Comprehensive global law enforcement takedown (Operation Cronos) of LockBit ransomware infrastructure, unmasking creator Dmitry Khoroshev (LockBitSupp) and multiple active affiliates who extorted over $500 million from thousands of victims.

Devastating ransomware attack and data extortion of Change Healthcare (UnitedHealth Group) that paralyzed medical billing, prescription processing, and healthcare provider reimbursement nationwide.

DarkSide ransomware extortion against the largest refined petroleum pipeline system in the United States, forcing the shutdown of 5,500 miles of fuel pipelines and triggering widespread East Coast fuel shortages.

Leader and core administrator of Evil Corp charged with deploying Bugat/Dridex banking malware and ransomware, stealing dozens of millions of dollars from bank accounts of municipalities, school districts, and businesses.

Department of Justice charges North Korean state-sponsored programmer with the 2014 Sony Pictures hack, the 2017 global WannaCry ransomware outbreak, and the $81 million Bangladesh Bank cyber heist.

Affiliate of Netwalker ransomware responsible for attacking dozens of healthcare systems, universities, and businesses during the COVID-19 pandemic, extorting tens of millions of dollars.

Ukrainian national and REvil ransomware affiliate responsible for deploying the ransomware attack that hijacked Kaseya VSA management software, instantly encrypting up to 1,500 downstream businesses on July 4th weekend.

Founder of Hong Kong-registered cryptocurrency exchange Bitzlato charged with laundering over $700 million in ransomware and darknet market illicit proceeds, serving as a primary financial conduit for Hydra Market.

Operator of ChipMixer, one of the dark web's largest unlicensed cryptocurrency mixing services, charged with laundering more than $3 billion in Bitcoin associated with ransomware, North Korean state hackers, and darknet drug markets.

Key software developers and coders of the transnational Trickbot cybercrime group charged with infecting millions of victim computers with banking trojans and facilitating Conti/Ryuk ransomware deployments against hospitals.

Russian national who traveled to Nevada and offered a $1 million Bitcoin bribe to an employee at the Tesla Gigafactory in Sparks, Nevada, to introduce malware onto the company's internal network.

British malware researcher who previously halted the global WannaCry ransomware outbreak charged with authoring the Kronos banking trojan and UPAS kit years earlier as a teenager.

Russian operator (Severa) of the notorious Kelihos botnet, controlling over 100,000 infected computers worldwide used to harvest credentials, distribute ransomware, and blast billions of spam and stock pump-and-dump emails daily.

Russian cryptocurrency trader and Instagram influencer who operated as a high-level money launderer for QQAAZZ, an all-in-one cashout network servicing Dridex, Trickbot, and BitPaymer ransomware gangs.

International enforcement action against REvil ransomware money exchangers and operators, recovering $6.1 million in ransomware proceeds extorted from businesses and local governments across the United States.

Sophisticated social engineering and ransomware attack carried out by cybercrime collective Scattered Spider partnering with ALPHV/BlackCat, utilizing a 10-minute phone call to the Okta IT helpdesk to bypass MFA, hijack administrative privileges, and paralyze hotel reservations, digital keys, and casino slot machines.

17-year-old hacker orchestrated a spearphishing and social engineering scheme targeting Twitter employees, gaining access to internal administrative customer service tools and hijacking 130 high-profile verified accounts (including Joe Biden, Barack Obama, Elon Musk, and Apple) to promote a fraudulent Bitcoin giveaway.

Destructive ransomware incident that incapacitated CDK Global, the premier SaaS dealer management platform for approximately 15,000 car dealerships across North America. Attackers deployed BlackSuit ransomware throughout CDK cloud and on-premises data centers, forcing dealership employees into pen-and-paper workarounds for weeks until an estimated $25 million ransom was transferred.

Global automated ransomware worm that weaponized the leaked NSA EternalBlue exploit (MS17-010) to self-propagate across 200,000 Windows computers in over 150 countries within hours, paralyzing 80 National Health Service (NHS) hospital trusts in the UK.

Federal indictment of Russian syndicate leader Evgeniy Bogachev for operating GameOver Zeus, a peer-to-peer banking trojan, and CryptoLocker, the first mass-market cryptoviral ransomware, stealing over $100 million with an unprecedented $3 million FBI Rewards for Justice bounty.

Severe ransomware incident paralyzing Ascension Health, one of the nation largest nonprofit Catholic hospital systems across 140 facilities in 14 states, forcing clinical staff to paper medical charts, diverting emergency trauma patients, and triggering CISA joint advisories on Russian-linked Black Basta operations.

Universal zero-day vulnerability in Apache Log4j (Log4Shell) where arbitrary JNDI lookup strings (${jndi:ldap://...}) processed by logger components permitted unauthenticated remote code execution, triggering mass scanning and exploitation across billions of enterprise cloud servers by nation-state actors and ransomware syndicates worldwide.

Coordinated multinational law enforcement action led by the FBI and DOJ that penetrated Hive ransomware network infrastructure for seven months, secretly capturing decryption keys to liberate over 1,300 victims worldwide and preventing $130 million in extortive ransom payments before seizing servers.

Landmark Securities and Exchange Commission enforcement order against public cloud software provider Blackbaud for making materially misleading disclosures concerning a May 2020 ransomware incident, omitting that attacker had exfiltrated unencrypted donor bank account and social security information while asserting sensitive data was not compromised.