4 ms·

What a clickbait headline. A paltry $3k and yet the article calls this a "MASSIVE ransomware outbreak". I would be curious to see what a "minor" outbreak is.

by mrb 9y ago

cynicalreason 9y ago
it's not, my previous company took everything offline - they got infected via connections to their offices in Ukraine. lots of companies in the Ukraine are infected. company I work for disabled all working from home VPN accounts for the time being until we do a security audit
SmallDeadGuy 9y ago
There are reports of hundreds to thousands of machines infected across multiple firms in multiple countries. I'd bet >99% of people are never gonna send the $300 in bitcoin to decrypt their machine, instead they'll just clean and restore as much as they can. The $3k is 11 people desperate to restore all their data now, more may come in the future after people have exhausted other options, but the vast majority will never pay unless their backups were hit too.
- mbaha 9y ago
  Exactly. This is a huge attack. The amounts paid don't mean a thing.
- 49para 9y ago
  Seems like a better approach would be to have the ransom increase higher after every person that paid. Just so you'd have some competetion to pay sooner.
paulpauper 9y ago
obviously, that number will grow
semi-extrinsic 9y ago
In Ukraine, banking services nationwide as well as credit card payments on the metro in Kiev, and the airport IT systems, are all down. At what point do we call it massive? When US banks and airports start having trouble?
- BoiledCabbage 9y ago
  That's interesting. I've heard a lot about Russia testing out cyberwarfare in Ukraine as a possible proving ground for future targets. Was Ukraine the hardest hit by this latest one? It'd be interesting if this were actually made to take down infrastructure under the guise of ransomware.
  - zzzcpan 9y ago
    Apparently initially the thing spread through the update of a popular Ukrainian accounting software [1], infecting a lot of networks of Ukrainian companies. [1] me-doc.com.ua
  - PeterisP 9y ago
    Ukraine seems to be explicitly targeted, with the initial distribution happening already for some time but having a trigger to start lateral infection (which would be detectable) only 27th June 10:30 ( https://twitter.com/CyberpoliceUA/status/879825132088426499 https://twitter.com/CyberpoliceUA/status/879825132088426499 ) and the actual ransom attacks only some hours after that; so it was intended to spread locally before attracting global attention.
dom0 9y ago
The conversion rate is likely very, very low for these, especially so soon after infection.
- mrb 9y ago
  You are right. I misjudged.
k-mcgrady 9y ago
Amount of money collected != scale of attack. Number of machines + importance of companies/systems = scale of attack.

What a clickbait headline. A paltry $3k and yet the article calls this a "MASSIVE ransomware outbreak". I would be curious to see what a "minor" outbreak is.

by mrb 9y ago

What a clickbait headline. A paltry $3k and yet the article calls this a "MASSIVE ransomware outbreak". I would be curious to see what a "minor" outbreak is.

cynicalreason 9y ago

it's not, my previous company took everything offline - they got infected via connections to their offices in Ukraine. lots of companies in the Ukraine are infected. company I work for disabled all working from home VPN accounts for the time being until we do a security audit

SmallDeadGuy 9y ago

There are reports of hundreds to thousands of machines infected across multiple firms in multiple countries. I'd bet >99% of people are never gonna send the $300 in bitcoin to decrypt their machine, instead they'll just clean and restore as much as they can. The $3k is 11 people desperate to restore all their data now, more may come in the future after people have exhausted other options, but the vast majority will never pay unless their backups were hit too.

mbaha 9y ago
Exactly. This is a huge attack. The amounts paid don't mean a thing.
49para 9y ago
Seems like a better approach would be to have the ransom increase higher after every person that paid. Just so you'd have some competetion to pay sooner.

paulpauper 9y ago

obviously, that number will grow

semi-extrinsic 9y ago

In Ukraine, banking services nationwide as well as credit card payments on the metro in Kiev, and the airport IT systems, are all down. At what point do we call it massive? When US banks and airports start having trouble?

BoiledCabbage 9y ago
That's interesting. I've heard a lot about Russia testing out cyberwarfare in Ukraine as a possible proving ground for future targets. Was Ukraine the hardest hit by this latest one? It'd be interesting if this were actually made to take down infrastructure under the guise of ransomware.
- zzzcpan 9y ago
  Apparently initially the thing spread through the update of a popular Ukrainian accounting software [1], infecting a lot of networks of Ukrainian companies. [1] me-doc.com.ua
- PeterisP 9y ago
  Ukraine seems to be explicitly targeted, with the initial distribution happening already for some time but having a trigger to start lateral infection (which would be detectable) only 27th June 10:30 ( https://twitter.com/CyberpoliceUA/status/879825132088426499 https://twitter.com/CyberpoliceUA/status/879825132088426499 ) and the actual ransom attacks only some hours after that; so it was intended to spread locally before attracting global attention.

dom0 9y ago

The conversion rate is likely very, very low for these, especially so soon after infection.

mrb 9y ago
You are right. I misjudged.

k-mcgrady 9y ago

Amount of money collected != scale of attack. Number of machines + importance of companies/systems = scale of attack.