4 ms·

What I don't get is the idea of trusting a criminal to live up to their promises if the victim pays up. "They would lose a lot of reputation if they broke thei

• zorked 6y ago
  I negotiated for a friend in a small ransomware case. They paid $2k. Yes, reputation is important, I did some research to check whether others had successfully negotiated. If you get a reputation for not delivering nobody will negotiate with you. Likewise if you have a good reputation the amount of money people are willing to risk on getting their data back goes up, and that's good for business. It's also a reason why the ransomware was very clearly branded. It's criminal but the principles of business still apply.
  • billpg 6y ago
    I may been a bit glib in my original post, but is there actually a website where ransomware gangs reputation are tracked?
    • wruza 6y ago
      In our case I googled the email address that was left in every folder and read forums on how their users dealt with it. We negotiated $2k to $400. My company bought a small business and it happened next day. A hole in RDP that was simply open to the internets. No backups, no failover, just a regular business, you know. Partially my fault, as this thing should have been evaluated/fixed before the deal. Convincing the owners that it wasn't me (I just got an administrative password) was a separate fun.
      • gowld 6y ago
        Seems like it was an inside job if it happened the same day.
        • benburleson 6y ago
          For $400 or even $2000? That's an awfully small payout for an enormous legal risk.
          • shadowprofile77 6y ago
            Yes, but multiply the ransom by multiple small, low ransom targets, as is commonly the case with groups taking a more diversified approach of targeting many small companies in the same attack type, partly depending on such small ransom demands to individually not even be reported to investigating authorities, and getting at least a partial ROI. This opposed to making a huge single demand from one large company that almost certainly causes your ransom attempt to trigger a police investigation and the not small chance of the company simply deciding not to pay, leaving you with 0 for that particular effort.
        • wruza 6y ago
          Unlikely, all things considered. With default port RDP on the internet it is just a matter of time, and then of a coincidence.
        • Teever 6y ago
          What about if it had happened 2 days later? or 3? What's the magic number to make you think that it was/wasn't an inside job?
    • jolmg 6y ago
      Even if there isn't, you can still probably copy and paste part of the ransomware message into Google and find stories of other people that interacted with them.
• InfiniteRand 6y ago
  Probably reputation among ransom-ware negotiators (by this I mean the cottage industry described in the original post)
  • ben509 6y ago
    Yup, the expected value of the key is P(valid_key) * savings_from_decrypting. So if you're known to negotiators as providing a valid key, it makes the likelihood of paying higher.
  • gowld 6y ago
    Ransomware "negotiators" are "affiliate salespeople", as I see it.
• leppr 6y ago
  > Even if there were, what's stopping the "bad" gangs from pretending to be the "good" ones? Trademarks? I have no idea if that is actually done, but the criminals could simply cryptographically sign a unique message for each attack.
• vmception 6y ago
  Although there are incentives, what is really being challenged, for you, is a childish view of a categorization. Ransomware operators are as trustworthy as any corporation, because they are a corporation.