Hillicon Valley — US strikes back against Kaseya attackers

Today is Monday. Welcome to Hillicon Valley, detailing all you need to know about tech and cyber news from Capitol Hill to Silicon Valley. Subscribe here: digital-staging.thehill.com/newsletter-signup.

Follow The Hill’s cyber reporter, Maggie Miller (@magmill95), and tech team, Chris Mills Rodrigo (@millsrodrigo) and Rebecca Klar (@rebeccaklar_), for more coverage.

The Biden administration came out swinging against individuals allegedly behind the recent ransomware attack on IT group Kaseya, in what the president called an example of the “full strength of the federal government” being brought in to combat such attacks. 

Meanwhile, on National STEM Day, Sens. Jacky Rosen (D-Nev.) and Shelley Moore Capito (R-W.Va.) launched a caucus aimed at closing the gender gap in science, technology, engineering and math careers. 

Let’s jump in.

Not a good day to be in the ransomware biz

The Justice Department on Monday announced that it had seized more than $6 million in ransomware victim payments as part of a sweeping effort crack down on hackers involved in ransomware attacks against U.S. companies. 

As part of this effort, the Justice Department indicted Ukrainian national Yaroslav Vasinskyi for his part in carrying out the ransomware attack on IT company Kaseya in July through the use of REvil ransomware. An indictment was also announced against Russian national Yevgeniy Polyanin, from whom $6.1 million in victim ransom payments was seized. 

In custody: Vasinskyi, who was taken into custody in Poland in October and awaits extradition to the United States, faces charges including conspiracy to commit fraud and money laundering. Vasinskyi faces up to 115 years in prison if convicted of all counts.

Polyanin remains at large abroad, but is charged with similar counts as Vasinskyi, and faces up to 145 years in prison if apprehended and convicted on all counts. 

Attorney General Merrick Garland announced the seizure of funds and the incidents during a press conference on Monday along with FBI Director Christopher Wray and Deputy Attorney General Lisa Monaco. He emphasized that “this will not be the last time” that the U.S. reclaims ransomware victim payments. 

But wait, there’s more: The Justice Department efforts are part of a wider set of actions undertaken by the Biden administration on Monday. 

The Treasury Department also announced sanctions against virtual currency exchange Chatex along with four other entities — IZIBITS OU, Chatextech SIA, and Hightrade Finance Ltd — for their alleged involvement in facilitating ransomware attack payments. 

Read more about the effort here.

Senators take on the STEM gender gap

Sens. Jacky Rosen (D-Nev.) and Shelley Moore Capito (R-W.Va.) are launching a bipartisan Women in STEM caucus focused on creating more access and pathways for women and girls to participate in science, technology, engineering and math careers. 

The caucus will offer a platform for lawmakers and industry leaders to discuss solutions to address the lack of diversity in STEM, the senators said. 

“We have to change the narrative for young girls, and maybe even for educators, because we want to have them be sure young girls see themselves doing these jobs and these jobs feel accessible,” Rosen told The Hill. 

It’s personal: Rosen came to the Senate with a background in computer programming, and although she said the gender gap has shrunk since she started in the industry in the 1980s, the progress has not gone far enough. 

Long way to go: According to the U.S. Census, as of 2019 women made up half of the workforce but only accounted for 27 percent of workers in STEM fields. 

The divide remains even more apparent in computer and engineering occupations, which made up 80 percent of the STEM workforce. Women represented only about a quarter of computer workers and 15 percent of those in engineering occupations, according to the Census report. 

Read more here. 

CHECK YOUR SOURCES

Seventy-five percent of unvaccinated parents said they distrust mainstream media and get most of their information from social media, according to a poll commissioned by progressive groups. 

But only 42 percent of vaccinated respondents said they prefer to get their information on social media, based on the YouGov Blue poll conducted for the groups SumofUs and Parents Together. 

The poll also found that nearly two thirds of American parents said they agree with the surgeon general that health misinformation is a problem on social media. Surgeon General Vivek Murthy in July issued an advisory warning calling health misinformation an “urgent threat.” 

However, whereas the poll found 73 percent of vaccinated parents said they think misinformation in social media is a significant problem, just 44 percent of those who were unvaccinated said they agree with the surgeon general’s statement. 

The poll is based on a base survey of 1,224 interviews online with parents of children under 18 who are enrolled in school or daycare. The surveys were conducted in September, before children under 12 were approved to get coronavirus vaccines.

NOT A GOOD DAY TO BE IN RANSOMWARE, PART TWO

Romanian authorities have arrested two individuals they say are linked to the use of REvil ransomware as part of a prolific hacking group tied to attacks on several major American companies in recent months. 

Europol on Monday announced the arrests, which took place Thursday, saying that the two individuals arrested are alleged to be behind more than 5,000 cyberattacks and are accused of having gained more than half a million Euros in ransomware payments made by victims. 

The arrests were the latest in a string of operations pursued by a coalition of international partners against REvil, with Europol saying Monday that five other cyber criminals with links to the group have been arrested since February. 

In total, all seven suspects have been connected to ransomware attacks that have impacted around 7,000 victims.

Read more here.

BEWARE EMISSARY PANDA

A hacking group with potential ties to China has breached nine global organizations as part of an ongoing espionage effort mostly targeting the defense sector, findings made public Sunday revealed. 

According to a report from cybersecurity company Palo Alto Networks, the hackers targeted at least 370 organizations running potentially vulnerable Zoho servers in the U.S. alone, successfully compromising at least one, as part of a wider global campaign. 

The compromised groups operated in the defense, education, energy, health care and technology sectors, with a potential focus on servers used by companies working with the Department of Defense. 

The report labels the Chinese threat group as “Emissary Panda.”

Read more here.

BITS AND PIECES

An op-ed to chew on: Do we really want Facebook and Amazon to rule AI?

Lighter click: NFT (nice frog tweet)

Notable links from around the web:

LAPD ended predictive policing programs amid public outcry. A new effort shares many of their flaws (The Guardian / Johana Bhuiyan)

How Facebook Is Stoking a Civil War in Ethiopia (Vice / Nick Robins-Early)

Report: NSO spyware found on 6 Palestinian activists’ phones (The Associated Press / Frank Bajak and Joseph Krauss)

One last thing: Israel distances from blacklisted firm

Israel’s Foreign Minister Yair Lapid on Saturday sought to distance the government from the NSO group, an Israeli company blacklisted by the U.S. earlier this week for allegedly providing phone hacking spyware to foreign governments for nefarious purposes.

“NSO is a private company, it is not a governmental project and therefore even if it is designated, it has nothing to do with the policies of the Israeli government,” Lapid said at a press conference, according to Reuters.

“I don’t think there is another country in the world which has such strict rules according to cyber warfare and that is imposing those rules more than Israel and we will continue to do so,” he added.

Read more here. 

That’s it for today, thanks for reading. Check out The Hill’s technology and cybersecurity pages for the latest news and coverage. We’ll see you Tuesday.