A group of blackhat hackers sent a significant sum of money to multiple charities, leaving some onlookers confused and troubled.
BBC reported on Oct. 20 that a cybercriminal organization known as Darkside posted receipts for $10,000 in Bitcoin donations to two charities. Darkside published the donation complete with tax receipts for the donation of 0.88 BTC to The Water Project and Children International.
Children International already warned that it would “never knowingly take money obtained through crime.” A spokesperson of the charity told BBC:
“If the donation is linked to a hacker, we have no intention of keeping it.”
Darkside hackers donated the money through a United States-based crypto charity donation service called The Giving Block. This service is already being used by 67 different non-profits from around the world including Save The Children, Rainforest Foundation and She’s The First.
The Giving Block told BBC that the firm was unaware that the donations were initiated by cybercriminals and is “still working to determine if these funds were actually stolen.” A spokesperson of the organization told the news outlet:
“If it turns out these donations were made using stolen funds, we will of course begin the work of returning them to the rightful owner.”
The hackers reportedly announced the donation on Oct. 13, claiming that they only target large companies and that they “think that it’s fair that some of the money the companies have paid will go to charity.” The also claimed that they feel happy about the donations:
“No matter how bad you think our work is, we are pleased to know that we helped changed [sic] someone’s life. Today we sended [sic] the first donations.”
Brett Callow, a threat analyst at cybersecurity firm Emsisoft, told BBC that it is unclear what the cybercrime group wants to obtain through those donations. He shared some theories with the journalists:
“Perhaps it helps assuage their guilt? Or perhaps for egotistical reasons they want to be perceived as Robin Hood-like characters rather than conscienceless extortionists.”
Furthermore, Callow noted that this is a rather noteworthy action on Darkside’s part, as this is “the first time a ransomware group has donated a portion of their profits to charity” that he knows of.
Ransomware is a growing concern
Ransomware is a type of malware—often also called a “computer virus”—that encrypts the data contained on the infected system and prevents the user from accessing it. To obtain the encryption key which allows the user to access the data once again, the user is asked for a ransom in cryptocurrency.
Cybercrime groups are incentivized to attack systems with important data with their ransomware, as this increases the probability that the victim will indeed pay them. Still, attacking critical systems often has unforeseen and sometimes even tragic consequences. As Modern Consensus reported in late September, the recent death of a German woman has been directly linked to a ransomware attack that crippled the hospital that she was in.