NetWalker Ransomware Gang Is Storing $7M in Bitcoin in SegWit Cold Storage
The organization that’s encrypting computers and extorting companies has taken to SegWit addresses, according to McAfee and CipherTrace.
Updated Sep 14, 2021 at 9:39 a.m. UTC
![(Ilya Pavlov/Unsplash)](https://www.coindesk.com/resizer/nu4i9IjpFIz3CTdwTKAWC6metWA=/567x343/filters:quality(80):format(jpg)/cloudfront-us-east-1.images.arcpublishing.com/coindesk/ABRIQI4TBRFJXNUBHYH2GKB2GM.jpg)
- NetWalker is a “ransomware-as-a-service” that gains its access through COVID-19 phishing emails, encrypts infected systems and steals internal documents. Ransomware operators then threaten to publish victims’ documents if they fail to pay up.
- Victims, most of whom are large organizations such as companies and governments, appear to been obliging the hackers throughout the pandemic. McAfee and CipherTrace traced 2,795 bitcoin ($25 million) to NetWalker wallet addresses from March 1 through July 27.
- NetWalker’s developers refined their handling of bitcoin payments months before the pandemic began by swapping in SegWit addresses in place of legacy wallets, the report said.
- “This transition into SegWit could indicate that they are utilizing a new hardware wallet to store their BTC or just an indication of a desire for cheaper transactions,” said Pamela Clegg, director of financial investigations at CipherTrace.
- Clegg told CoinDesk that “large amounts of bitcoin” – up to 640 – appear to be sitting in cold storage. She said smaller amounts have been deposited at Russian crypto exchange CointoCard.org.
- The cybersecurity report follows last week’s warning from the FBI that NetWalker has been successfully exploiting COVID-19 in recent months. The FBI warns targeted institutions against paying hackers’ bitcoin ransom payments.