Wallets tied to CDK ransom group received $25 million two days after attack | CyberScoop<\/title> <meta name=\"description\" content=\"Researchers say the wallets that received the large bitcoin payment are tied to BlackSuit affiliates \"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/cdk-ransom-blacksuit-25-million\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Wallets tied to CDK ransom group received $25 million two days after attack \"> <meta property=\"og:description\" content=\"Researchers say the wallets that received the large bitcoin payment are tied to BlackSuit affiliates \"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/cdk-ransom-blacksuit-25-million\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-07-12T15:05:52+00:00\"> <meta property=\"article:modified_time\" content=\"2024-07-12T15:06:38+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1278\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"AJ Vicens\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@AJVicens\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1720117134g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1720540669g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1720001752g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=74528d75ce0daeb8628a\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/81004\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.5.5\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=81004\">\n<link rel=\"alternate\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fcdk-ransom-blacksuit-25-million%2F\">\n<link rel=\"alternate\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fcdk-ransom-blacksuit-25-million%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-81004 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/cdk-ransom-blacksuit-25-million\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.560634328358\">\n<div class=\"single-article__header-content\" readability=\"30.13698630137\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/threats\/cybercrime\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul>\n<p> Researchers say the wallets that received the large bitcoin payment are tied to BlackSuit affiliates. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack-2.jpg?resize=768,511 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack-2.jpg?resize=1024,682 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack-2.jpg?resize=1536,1022 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack-2.jpg?resize=600,399 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack-2.jpg?resize=1014,675 1014w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack-2.jpg?resize=1266,843 1266w\" sizes=\"(max-width: 1014px) 100vw, 1014px\"><figcaption> Jeep vehicles are delivered to a dealership on June 20, 2024 in Chicago, Illinois. A cyber attack on CDK Global, a software provider that helps dealerships manage sales and service, has crippled the workflow at approximately 15,000 dealerships across the United States and Canada. (Photo by Scott Olson\/Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"38.304326689353\"><body readability=\"76.971252566735\"><\/p>\n<p>The ransomware group linked to a June cyberattack against auto industry software provider CDK Global received a payment of more than $25 million two days after the attack that hobbled software used by roughly 15,000 car dealerships in the U.S. became public, researchers told CyberScoop. <\/p>\n<p>A cryptocurrency wallet likely controlled by BlackSuit \u2014 the ransomware group <a href=\"https:\/\/cyberscoop.com\/cdk-ransomware-car-dealers\/\">believed to be responsible<\/a> for the attack \u2014 received approximately 387 bitcoin on June 21, worth roughly $25 million, researchers with blockchain intelligence firm TRM Labs told CyberScoop. <\/p>\n<p>The evidence uncovered by TRM Labs is firmest evidence yet to indicate that CDK Global paid a ransom in order to resolve the attack on its systems, though TRM\u2019s findings do not conclusively prove that the payment came from CDK.<\/p>\n<p>Representatives for the company and its parent firm, Brookfield Business Partners, have refused to answer questions about whether CDK or a representative made a ransom payment. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>If confirmed, the $25 million payment would be the second-largest ransom payment on record, trailing only the <a href=\"https:\/\/www.bloomberg.com\/news\/articles\/2021-05-20\/cna-financial-paid-40-million-in-ransom-after-march-cyberattack\">$40 million paid by CNA Financial Corp. in 2021<\/a>. It would be the second known ransom payment to cross $20 million this year, after UnitedHealth Group paid attackers tied to the now defunct ALPHV ransomware operation <a href=\"https:\/\/cyberscoop.com\/alphv-steps-up-laundering-of-change-healthcare-ransom-payments\/\">$22 million to resolve an attack on its Change Healthcare<\/a> subsidiary. <\/p>\n<p>After the $25 payment was made to the wallet controlled by BlackSuit, roughly $15 million of the funds \u201cmoved through a complex set of nearly 200 transactions following a common money laundering typology, then was distributed across more than 20 addresses at five different global exchanges,\u201d the firm told CyberScoop in an email.<\/p>\n<p>A little more than $6 million in funds were also moved from the initial wallet and deposited across more than 15 addresses across four global exchanges, with movements continuing through Tuesday, TRM Labs said. <\/p>\n<p>One of the wallets that received a deposit appears to belong to an active BlackSuit affiliate, the researchers added. That address had previously received funds from \u201cseveral known BlackSuit and Wizard Spider victim payments,\u201d the researchers said. <\/p>\n<p>Wizard Spider is a name used to track a separate set of longrunning financially-motivated cybercriminal activity with ties to the Russian cybercrime ecosystem, <a href=\"https:\/\/www.crowdstrike.com\/blog\/wizard-spider-adversary-update\/\">industry<\/a> and <a href=\"https:\/\/www.cisa.gov\/news-events\/cybersecurity-advisories\/aa20-302a\">government<\/a> researchers have said.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Another source familiar with the matter confirmed that an approximately $25 million payment was made to a BlackSuit-linked wallet.<\/p>\n<p>The payment came the same day <a href=\"https:\/\/www.bloomberg.com\/news\/articles\/2024-06-21\/cdk-hackers-want-millions-in-ransom-to-end-car-dealership-outage\">Bloomberg reported<\/a> that the CDK Global attackers were demanding \u201ctens of millions of dollars in ransom\u201d and that the company was planning to make the payment. CNN was the <a href=\"https:\/\/www.cnn.com\/2024\/07\/11\/business\/cdk-hack-ransom-tweny-five-million-dollars\/index.html\">first to report<\/a> the $25 million transaction.<\/p>\n<p>CDK Global, which is owned by Canada-based Brookfield Business Partners, began investigating a \u201ccyber incident\u201d the morning of June 19 and shut down \u201cmost\u201d of its systems that day \u201cout of an abundance of caution,\u201d followed by a second incident that day, CDK Senior Manager of External Communications Lisa Finney <a href=\"https:\/\/cyberscoop.com\/cdk-ransomware-car-dealers\/\">told CyberScoop June 20<\/a>. Tony Macrito, CDK Global\u2019s senior director of communications, told CyberScoop Friday that all of the company\u2019s major applications are now available.<\/p>\n<p>The incident led to <a href=\"https:\/\/www.cnn.com\/2024\/06\/28\/business\/cdk-massive-car-dealership-outage\/index.html\">widespread disruption<\/a> at auto dealerships across the country. At least six publicly traded auto dealership firms <a href=\"https:\/\/cyberscoop.com\/cdk-ransomware-car-dealers\/\">said in filings with the Securities and Exchange Commission<\/a> that the incident had affected their business operations.<\/p>\n<p>Brookfield Business Partners <a href=\"https:\/\/ca.finance.yahoo.com\/news\/brookfield-business-partners-provides-restoration-120000784.html\">said in a July 3 press release<\/a> that the company did not expect the incident to have a material impact on its business. Companies <a href=\"https:\/\/www.jdsupra.com\/legalnews\/sec-corporation-finance-provides-6739637\/\">are required<\/a> by the SEC to \u201cmake a materiality determination\u201d following a ransomware attack and, if it determines an incident is material, disclose it within four days of the determination.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.2511520737327\">\n<div class=\"author-card\" readability=\"8\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack-1.jpg?w=640&ssl=1\" alt=\"AJ Vicens\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by AJ Vicens<\/h4>\n<p> AJ covers nation-state threats and cybercrime. He was previously a reporter at Mother Jones. Get in touch via Signal\/WhatsApp: (810-206-9411). <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/cdk-ransom-blacksuit-25-million\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Wallets tied to CDK ransom group received $25 million two<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2321,2322,282,323,46,2323],"tags":[2324,2325,286,327,54,2326],"class_list":["post-4433","post","type-post","status-publish","format-standard","hentry","category-blacksuit","category-cdk-global","category-cybercrime","category-extortion","category-ransomware","category-trm-labs","tag-blacksuit","tag-cdk-global","tag-cybercrime","tag-extortion","tag-ransomware","tag-trm-labs"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/blacksuit\/\" rel=\"category tag\">BlackSuit<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cdk-global\/\" rel=\"category tag\">CDK Global<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/extortion\/\" rel=\"category tag\">extortion<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ransomware\/\" rel=\"category tag\">ransomware<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/trm-labs\/\" rel=\"category tag\">TRM Labs<\/a>","tag_info":"TRM Labs","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4433","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=4433"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4433\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=4433"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=4433"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=4433"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":4433,"date":"2024-07-12T10:05:52","date_gmt":"2024-07-12T15:05:52","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=81004"},"modified":"2024-07-12T10:05:52","modified_gmt":"2024-07-12T15:05:52","slug":"wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/07\/12\/wallets-tied-to-cdk-ransom-group-received-25-million-two-days-after-attack\/","title":{"rendered":"Wallets tied to CDK ransom group received $25 million two days after attack\u00a0"},"content":{"rendered":"