4 ms·

according to the article, the balances of the bitcoin addresses collecting the ransoms are 15.13562354 BTC = $26410 13.78022431 BTC = $24045 5.98851225 BTC = $

according to the article, the balances of the bitcoin addresses collecting the ransoms are 15.13562354 BTC = $26410 13.78022431 BTC = $24045 5.98851225 BTC = $17361 Assuming $300 per ransom, this works out to a total of 226 victims who paid. this seems a little low compared to the huge amount of infected devices.

Belphemur 9y ago
Did you check the transactions? They could have already moved a part of the coins to an exchange.
- kbody 9y ago
  Last time I checked none of the coins were ever moved and in general ransomware earnings are not moved. They're just waiting for fungibility on Bitcoin.
- ConfucianNardin 9y ago
  According to blockchain.info, no coins have been moved from the addresses in the article.
- deleted 9y ago
  [deleted]
wyldfire 9y ago
Earlier reports I'd heard said that this group was unprepared or poorly prepared to handle the incoming ransom. Many of these ransomware campaigns use a fully automated mechanism to deliver keys upon payment, this group did not.
- koolba 9y ago
  How does that work in practice? Do the decryption keys get stored in the block chain as well or out of band?
  - pas 9y ago
    out-of-band, probably sent via email or managed through the "malware app" itself.
- j_s 9y ago
  One of the main pain points was using the same Bitcoin address as a destination rather than unique-per-victim... it gets confusing to prove who paid.
unklefolk 9y ago
I think this venn diagram explain part of the problem: https://www.trustar.co/wp-content/uploads/2017/05/WannaCryVenn.jpg https://www.trustar.co/wp-content/uploads/2017/05/WannaCryVe...
- pas 9y ago
  How did the 300M USD CryptoWall cashed that much?
  - unklefolk 9y ago
    That's a good question. Here is a link to the numbers: http://thehackernews.com/2015/10/cryptowall-ransomware.html http://thehackernews.com/2015/10/cryptowall-ransomware.html That averages out at $800 per infection compared to about $0.30 per infection from WannaCry. I suspect there are other factors at play here (was all the revenue from ransoms? were that target systems different? are people hardening in their resolve not to pay these ransoms?).
kbody 9y ago
It's easy to find out the total. There's even a twitter bot[1] reporting it. At the moment the total is 44.98BTC = $80,925. I'd argue ofc it's more because there are some variations of the worm that's not being accounted by many yet. [1]: https://twitter.com/ransomtracker https://twitter.com/ransomtracker
vxNsr 9y ago
I was listening to an NPR report on this and their explanation for the low amount was that the group wasn't handing over the keys after payment. Which I guess implies people who get infected are first researching what to do before paying.

Belphemur 9y ago

Did you check the transactions? They could have already moved a part of the coins to an exchange.

kbody 9y ago
Last time I checked none of the coins were ever moved and in general ransomware earnings are not moved. They're just waiting for fungibility on Bitcoin.
ConfucianNardin 9y ago
According to blockchain.info, no coins have been moved from the addresses in the article.
deleted 9y ago
[deleted]

wyldfire 9y ago

Earlier reports I'd heard said that this group was unprepared or poorly prepared to handle the incoming ransom. Many of these ransomware campaigns use a fully automated mechanism to deliver keys upon payment, this group did not.

koolba 9y ago
How does that work in practice? Do the decryption keys get stored in the block chain as well or out of band?
- pas 9y ago
  out-of-band, probably sent via email or managed through the "malware app" itself.
j_s 9y ago
One of the main pain points was using the same Bitcoin address as a destination rather than unique-per-victim... it gets confusing to prove who paid.

unklefolk 9y ago

I think this venn diagram explain part of the problem: https://www.trustar.co/wp-content/uploads/2017/05/WannaCryVenn.jpg https://www.trustar.co/wp-content/uploads/2017/05/WannaCryVe...

pas 9y ago
How did the 300M USD CryptoWall cashed that much?
- unklefolk 9y ago
  That's a good question. Here is a link to the numbers: http://thehackernews.com/2015/10/cryptowall-ransomware.html http://thehackernews.com/2015/10/cryptowall-ransomware.html That averages out at $800 per infection compared to about $0.30 per infection from WannaCry. I suspect there are other factors at play here (was all the revenue from ransoms? were that target systems different? are people hardening in their resolve not to pay these ransoms?).

kbody 9y ago

It's easy to find out the total. There's even a twitter bot[1] reporting it. At the moment the total is 44.98BTC = $80,925. I'd argue ofc it's more because there are some variations of the worm that's not being accounted by many yet. [1]: https://twitter.com/ransomtracker https://twitter.com/ransomtracker

vxNsr 9y ago

I was listening to an NPR report on this and their explanation for the low amount was that the group wasn't handing over the keys after payment. Which I guess implies people who get infected are first researching what to do before paying.