3 ms·
Exactly. >It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties. Indeed. It just so happens that the vast ma
by meowface 5y ago
Exactly.
>It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties.
Indeed. It just so happens that the vast majority of these ransomware gangs operate out of Russia and neighboring states. Probably in part due to the confluence of good technical education options, a huge population, and a government that permits the activity. (Not trying to say anything about Russia or Russians but just its government's policy. If it were the US that had this policy, I'm sure the biggest ransomware gangs would operate in the US, instead.)
Another thing that reminds me of piracy (and also EVE Online piracy, for anyone who's played that game) is the strict adherence to the basic pirate code of honoring ransoms so that future victims will be willing to pay. They're as ruthless as they can be before payment, but if the victim cooperates and pays, then they'll keep their word - they provide the decryption key, don't release any of their data, and mark them to not be targeted in future ransomware campaigns. It's solely about making as much money as possible.
- anonymousDan 5y agoHi, I would be super interested in any evidence you could provide that ransomware authors won't target victims in future ransomware campaigns.
- TedDoesntTalk 5y agoEspecially since that implies they all work together and maintain lists of forbidden targets.
- meowface 5y agoI'm specifically referring to a single group/gang/operator. It doesn't mean a different operator - perhaps using the exact same ransomware software as the initial attacker - won't target them. It might exist, but I'm not aware of any list-sharing between unaffiliated operators.
- meowface 5y agoI'm specifically referring to a single group/gang/operator. It doesn't mean a different operator - perhaps using the exact same ransomware software as the initial attacker - won't target them. It might exist, but I'm not aware of any list-sharing between unaffiliated operators. I can't find a source right now and don't know for a fact how many do this, but I know I've read in at least one interview that a ransomware operator at least claimed they did this. And regardless of what actually happens in reality - in my opinion, the most economically rational choice would be for all ransomware operators to do this (and to punish other ransomware operators who don't). In general, many of them seem to try to maintain a reputation of honesty and integrity, despite the obvious juxtaposition with the very immoral behavior. I wrote more about this here: https://news.ycombinator.com/item?id=27102646 https://news.ycombinator.com/item?id=27102646