What Happened
On Nov. 4, the U.S. State Department announced rewards of up to $10 million for information that leads to the identification or location of any individual(s) holding key positions in the DarkSide ransomware group.

Why It Matters
The United States could list DarkSide on the Treasury Department’s Office of Foreign Assets Control sanctions lists, similar to the way it listed Russian cybercriminal group EvilCorp in 2019. The bounty program — especially if it extends to other prominent groups like REvil — may shift cybercriminals away from infrequent high-profile targets and toward frequent low-profile targets to escape U.S. persecution. The program will also lead to distrust within the cybercriminal community regarding partners and affiliates who may work with Western law enforcement to receive a reward.

Background
DarkSide was behind the Colonial Pipeline ransomware attack in May. The United States has previously offered bounties for cybercriminals, including multi-million dollar rewards for information connected to North Korean hackers and attacks on U.S. elections.