8 ms·

A friend sent me the bitcoin address, they've already collected 2600$. [EDIT] Now 3230$ Source: https://blockchain.info/address/1Mz7153HMuxXTuR2R1t78mGSdzaAtN

by mbaha 9y ago

A friend sent me the bitcoin address, they've already collected 2600$. [EDIT] Now 3230$ Source: https://blockchain.info/address/1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX https://blockchain.info/address/1Mz7153HMuxXTuR2R1t78mGSdzaA...

mrb 9y ago
What a clickbait headline. A paltry $3k and yet the article calls this a "MASSIVE ransomware outbreak". I would be curious to see what a "minor" outbreak is.
- cynicalreason 9y ago
  it's not, my previous company took everything offline - they got infected via connections to their offices in Ukraine. lots of companies in the Ukraine are infected. company I work for disabled all working from home VPN accounts for the time being until we do a security audit
- SmallDeadGuy 9y ago
  There are reports of hundreds to thousands of machines infected across multiple firms in multiple countries. I'd bet >99% of people are never gonna send the $300 in bitcoin to decrypt their machine, instead they'll just clean and restore as much as they can. The $3k is 11 people desperate to restore all their data now, more may come in the future after people have exhausted other options, but the vast majority will never pay unless their backups were hit too.
  - mbaha 9y ago
    Exactly. This is a huge attack. The amounts paid don't mean a thing.
  - 49para 9y ago
    Seems like a better approach would be to have the ransom increase higher after every person that paid. Just so you'd have some competetion to pay sooner.
- paulpauper 9y ago
  obviously, that number will grow
- semi-extrinsic 9y ago
  In Ukraine, banking services nationwide as well as credit card payments on the metro in Kiev, and the airport IT systems, are all down. At what point do we call it massive? When US banks and airports start having trouble?
  - BoiledCabbage 9y ago
    That's interesting. I've heard a lot about Russia testing out cyberwarfare in Ukraine as a possible proving ground for future targets. Was Ukraine the hardest hit by this latest one? It'd be interesting if this were actually made to take down infrastructure under the guise of ransomware.
    - zzzcpan 9y ago
      Apparently initially the thing spread through the update of a popular Ukrainian accounting software [1], infecting a lot of networks of Ukrainian companies. [1] me-doc.com.ua
    - PeterisP 9y ago
      Ukraine seems to be explicitly targeted, with the initial distribution happening already for some time but having a trigger to start lateral infection (which would be detectable) only 27th June 10:30 ( https://twitter.com/CyberpoliceUA/status/879825132088426499 https://twitter.com/CyberpoliceUA/status/879825132088426499 ) and the actual ransom attacks only some hours after that; so it was intended to spread locally before attracting global attention.
- dom0 9y ago
  The conversion rate is likely very, very low for these, especially so soon after infection.
  - mrb 9y ago
    You are right. I misjudged.
- k-mcgrady 9y ago
  Amount of money collected != scale of attack. Number of machines + importance of companies/systems = scale of attack.
nyolfen 9y ago
it seems like a trivially avoidable mistake to use a single wallet for all collections, but maybe i shouldn't be giving them ideas...
- paulpauper 9y ago
  how do you konw it's only one wallet
  - Phlarp 9y ago
    Every infection is showing the same address.
- likelynew 9y ago
  Why do you think it a mistake?
  - davidsong 9y ago
    Because now we can watch those funds and know how much money they made, we can watch them to see if they make a mistake. If every address was different we'd have no idea how much money they're making and only funds paid by people who also reported them would be tainted by the long eyeball of the law.
    - likelynew 9y ago
      It does not seem like something wrong directly. I also think showing off might be intention.
      - Theodores 9y ago
        They should have pre-loaded more onto the wallet to give the impression that most people are paying. Less than £10K USD gives the impression that nobody is paying. It is the same psychology as a product only getting a couple of two star reviews - you don't buy it, you go for the product with hundreds of 4-5 star reviews instead.
strictnein 9y ago
I like one of the more recent transactions: https://blockchain.info/tx/82698e1f2fbf31914019da738e24515ae4e7d0510cfc4abb044b207c0e391334 https://blockchain.info/tx/82698e1f2fbf31914019da738e24515ae... For 0.0000666 BTC. Sender is theoretically 1FuckYouRJBmXYF29J7dp4mJdKyLyaWXW6
- wybiral 9y ago
  The only other transaction that account has made was to one of the WannaCry addresses. Also a tiny amount.
- unfunco 9y ago
  Similarly, with regards to 666ing: https://www.reddit.com/r/SheepMarketplace/comments/1rvlft/i_just_chased_him_through_a_bitcoin_tumbler_and/ https://www.reddit.com/r/SheepMarketplace/comments/1rvlft/i_...
  - strictnein 9y ago
    Very interesting read
franciskim 9y ago
Thanks for the address, I made a live counter here: https://franciskim.co/petya-ransomware-live-counter-ransom-dollars-paid/ https://franciskim.co/petya-ransomware-live-counter-ransom-d... Refreshes every 2 seconds.
holtalanm 9y ago
Update: Over $4000 now

by mbaha 9y ago

mrb 9y ago

What a clickbait headline. A paltry $3k and yet the article calls this a "MASSIVE ransomware outbreak". I would be curious to see what a "minor" outbreak is.

cynicalreason 9y ago
it's not, my previous company took everything offline - they got infected via connections to their offices in Ukraine. lots of companies in the Ukraine are infected. company I work for disabled all working from home VPN accounts for the time being until we do a security audit
SmallDeadGuy 9y ago
There are reports of hundreds to thousands of machines infected across multiple firms in multiple countries. I'd bet >99% of people are never gonna send the $300 in bitcoin to decrypt their machine, instead they'll just clean and restore as much as they can. The $3k is 11 people desperate to restore all their data now, more may come in the future after people have exhausted other options, but the vast majority will never pay unless their backups were hit too.
- mbaha 9y ago
  Exactly. This is a huge attack. The amounts paid don't mean a thing.
- 49para 9y ago
  Seems like a better approach would be to have the ransom increase higher after every person that paid. Just so you'd have some competetion to pay sooner.
paulpauper 9y ago
obviously, that number will grow
semi-extrinsic 9y ago
In Ukraine, banking services nationwide as well as credit card payments on the metro in Kiev, and the airport IT systems, are all down. At what point do we call it massive? When US banks and airports start having trouble?
- BoiledCabbage 9y ago
  That's interesting. I've heard a lot about Russia testing out cyberwarfare in Ukraine as a possible proving ground for future targets. Was Ukraine the hardest hit by this latest one? It'd be interesting if this were actually made to take down infrastructure under the guise of ransomware.
  - zzzcpan 9y ago
    Apparently initially the thing spread through the update of a popular Ukrainian accounting software [1], infecting a lot of networks of Ukrainian companies. [1] me-doc.com.ua
  - PeterisP 9y ago
    Ukraine seems to be explicitly targeted, with the initial distribution happening already for some time but having a trigger to start lateral infection (which would be detectable) only 27th June 10:30 ( https://twitter.com/CyberpoliceUA/status/879825132088426499 https://twitter.com/CyberpoliceUA/status/879825132088426499 ) and the actual ransom attacks only some hours after that; so it was intended to spread locally before attracting global attention.
dom0 9y ago
The conversion rate is likely very, very low for these, especially so soon after infection.
- mrb 9y ago
  You are right. I misjudged.
k-mcgrady 9y ago
Amount of money collected != scale of attack. Number of machines + importance of companies/systems = scale of attack.

nyolfen 9y ago

it seems like a trivially avoidable mistake to use a single wallet for all collections, but maybe i shouldn't be giving them ideas...

paulpauper 9y ago
how do you konw it's only one wallet
- Phlarp 9y ago
  Every infection is showing the same address.
likelynew 9y ago
Why do you think it a mistake?
- davidsong 9y ago
  Because now we can watch those funds and know how much money they made, we can watch them to see if they make a mistake. If every address was different we'd have no idea how much money they're making and only funds paid by people who also reported them would be tainted by the long eyeball of the law.
  - likelynew 9y ago
    It does not seem like something wrong directly. I also think showing off might be intention.
    - Theodores 9y ago
      They should have pre-loaded more onto the wallet to give the impression that most people are paying. Less than £10K USD gives the impression that nobody is paying. It is the same psychology as a product only getting a couple of two star reviews - you don't buy it, you go for the product with hundreds of 4-5 star reviews instead.

strictnein 9y ago

I like one of the more recent transactions: https://blockchain.info/tx/82698e1f2fbf31914019da738e24515ae4e7d0510cfc4abb044b207c0e391334 https://blockchain.info/tx/82698e1f2fbf31914019da738e24515ae... For 0.0000666 BTC. Sender is theoretically 1FuckYouRJBmXYF29J7dp4mJdKyLyaWXW6

wybiral 9y ago
The only other transaction that account has made was to one of the WannaCry addresses. Also a tiny amount.
unfunco 9y ago
Similarly, with regards to 666ing: https://www.reddit.com/r/SheepMarketplace/comments/1rvlft/i_just_chased_him_through_a_bitcoin_tumbler_and/ https://www.reddit.com/r/SheepMarketplace/comments/1rvlft/i_...
- strictnein 9y ago
  Very interesting read

franciskim 9y ago

Thanks for the address, I made a live counter here: https://franciskim.co/petya-ransomware-live-counter-ransom-dollars-paid/ https://franciskim.co/petya-ransomware-live-counter-ransom-d... Refreshes every 2 seconds.

holtalanm 9y ago

Update: Over $4000 now