“Microsoft Reveals its Role in Tracing the Medibank Attacker

The Australian Signals Directorate received critical assistance in identifying the perpetrator behind the 2022 Medibank cyber attack, thanks to information provided by Microsoft. In a recent disclosure, Microsoft acknowledged playing a "key role" in contributing valuable data to the investigation.

The Australian federal government officially attributed the cyber attack to Aleksandr Ermakov, a 33-year-old Russian national known by various aliases, including Alexander Ermakov, GustaveDore, aiiis_ermak, blade_runner, and JimJones. In response, the government imposed "targeted financial sanctions" and a travel ban on Ermakov. These sanctions criminalize the provision of assets to him or the use and handling of his assets, encompassing cryptocurrency wallets and ransomware payments.

Mark Anderson, Microsoft's National Security Officer for Australia and New Zealand, shed light on the collaborative efforts behind the scenes of the investigation. He emphasized the synergy between the Australian government and organizations like Microsoft in tracking cybercriminals.

Microsoft's Threat Intelligence Centre (MSTIC) played a pivotal role by providing substantial evidence for the Medibank cyber attack investigation, according to Anderson. He highlighted MSTIC's daily tracking of over 300 unique threat actors, including 160 nation-state actors and 50 ransomware groups. This case exemplifies the significance of global public and private partnerships in conducting successful cybercrime investigations.

Anderson emphasized that each identification of cybercriminals and disruption of cybercrime infrastructure contributes valuable lessons to the ongoing fight against cyber threats."