4 ms·

I may been a bit glib in my original post, but is there actually a website where ransomware gangs reputation are tracked?

by billpg 6y ago

wruza 6y ago
In our case I googled the email address that was left in every folder and read forums on how their users dealt with it. We negotiated $2k to $400. My company bought a small business and it happened next day. A hole in RDP that was simply open to the internets. No backups, no failover, just a regular business, you know. Partially my fault, as this thing should have been evaluated/fixed before the deal. Convincing the owners that it wasn't me (I just got an administrative password) was a separate fun.
- gowld 6y ago
  Seems like it was an inside job if it happened the same day.
  - benburleson 6y ago
    For $400 or even $2000? That's an awfully small payout for an enormous legal risk.
    - shadowprofile77 6y ago
      Yes, but multiply the ransom by multiple small, low ransom targets, as is commonly the case with groups taking a more diversified approach of targeting many small companies in the same attack type, partly depending on such small ransom demands to individually not even be reported to investigating authorities, and getting at least a partial ROI. This opposed to making a huge single demand from one large company that almost certainly causes your ransom attempt to trigger a police investigation and the not small chance of the company simply deciding not to pay, leaving you with 0 for that particular effort.
  - wruza 6y ago
    Unlikely, all things considered. With default port RDP on the internet it is just a matter of time, and then of a coincidence.
  - Teever 6y ago
    What about if it had happened 2 days later? or 3? What's the magic number to make you think that it was/wasn't an inside job?
jolmg 6y ago
Even if there isn't, you can still probably copy and paste part of the ransomware message into Google and find stories of other people that interacted with them.

I may been a bit glib in my original post, but is there actually a website where ransomware gangs reputation are tracked?

by billpg 6y ago

I may been a bit glib in my original post, but is there actually a website where ransomware gangs reputation are tracked?

wruza 6y ago

In our case I googled the email address that was left in every folder and read forums on how their users dealt with it. We negotiated $2k to $400. My company bought a small business and it happened next day. A hole in RDP that was simply open to the internets. No backups, no failover, just a regular business, you know. Partially my fault, as this thing should have been evaluated/fixed before the deal. Convincing the owners that it wasn't me (I just got an administrative password) was a separate fun.

gowld 6y ago
Seems like it was an inside job if it happened the same day.
- benburleson 6y ago
  For $400 or even $2000? That's an awfully small payout for an enormous legal risk.
  - shadowprofile77 6y ago
    Yes, but multiply the ransom by multiple small, low ransom targets, as is commonly the case with groups taking a more diversified approach of targeting many small companies in the same attack type, partly depending on such small ransom demands to individually not even be reported to investigating authorities, and getting at least a partial ROI. This opposed to making a huge single demand from one large company that almost certainly causes your ransom attempt to trigger a police investigation and the not small chance of the company simply deciding not to pay, leaving you with 0 for that particular effort.
- wruza 6y ago
  Unlikely, all things considered. With default port RDP on the internet it is just a matter of time, and then of a coincidence.
- Teever 6y ago
  What about if it had happened 2 days later? or 3? What's the magic number to make you think that it was/wasn't an inside job?

jolmg 6y ago

Even if there isn't, you can still probably copy and paste part of the ransomware message into Google and find stories of other people that interacted with them.