4 ms·

Why should I believe this? They can shut down their servers, move their crypto to different wallets, and pop up again in a few weeks, right?

specialp 5y ago
They know that they can and will be found, and are running scared. In general ransomware works because it takes a lot of resources to find the criminals behind it. And generally there's not enough resources to do this. But once it hits a level where it creates a widespread national problem, it becomes more of an act of war. Then you get people involved that aren't just law enforcement and have tools that aren't available to law enforcement with large budgets.
- ttul 5y ago
  Not to mention diplomatic channels to apply pressure on local governments that may have previously lacked the impetus to do anything about these groups.
- jl2718 5y ago
  I don’t understand how ransom ware works at all. The address is known well in advance, so a miner knows they might face sanction of their own coins for including it in their block. Not worth it.
- snypher 5y ago
  Running scared though? I see this as the dash from 2nd plate to 3rd. If you're going to ditch your servers and wash your coins you might as well make it seem like you were compromised. I don't think there's any fear here as they surely must have anticipated the consequences.
sfotm 5y ago
I’m skeptical as well. They know they built up a little too much notoriety and want to exit the game, is my guess. A core set of people can live pretty comfortably off of the ransom here, though they’ll have a hard time laundering it.
stickfigure 5y ago
Agreed, except why bother pop up again? They just got a big fat payment of $5m. Plenty to split with a small team. It's a good time to cash out and disappear.
- SavantIdiot 5y ago
  Seriously! It's FIVE MILLION. That's "I don't ever have to work again" money. What is wrong with people! Probably they want Mercedes, and Rolexes, and Mont Blanc pens and all that showy consumer garbage.
  - colechristensen 5y ago
    The median lifetime earnings in the US is 1.7 million, and that’s equivalent to... $20 an hour or so. 5 million is “never work again” money for a couple of people who want middle class incomes the rest of their lives... it is not really that much when spread over more than a few people.
    - showerst 5y ago
      Darkside is likely based in Russia, where lifetime median earnings are much lower.
      - jandrese 5y ago
        They're also going to lose a big chunk of that to money laundering losses. But since it is in Bitcoin it's probably going to appreciate over time. The problem is that if they fuck it up just once the record will be on the blockchain forever and they'll never be safe.
    - stickfigure 5y ago
      These people likely do not live in the US. Also, how big do you think the core team is? I would assume they're freezing out anyone who can't identify the culprits.
    - 5y ago
timdellinger 5y ago
It's plausible that this is all a scheme to evade capture. Disband the current organization, (get rid of a few people who you've wanted to jettison anyway), and then set up shop afresh elsewhere. It sends the message to whoever's looking for you that the whole thing has been burned to the ground and there's nothing to raid or seize or shut down.
- bluGill 5y ago
  Possible, but there is too much a chance that the cops already know who you are and just need to gather evidence in a form they can take to court. By shutting down they ensure that no more evidence is gathered. By starting a new organization they can't be sure that they aren't still being watched.
bluetwo 5y ago
Depends if the DOJ issues arrest warrants for the members in a couple weeks.
- SavantIdiot 5y ago
  Since they aren't in the US, it is probably more of a proactive step by the DOJ to build a case for sanctions. Assuming they know what country the perps are from, which doesn't seem all that clear.
  - bluGill 5y ago
    There are only a handful of countries that won't accept the US arrest warrants and turn over whoever. A few countries will demand something first, but this means no death penalty, not something that is in anyway a big deal for the other country. It is semi-routine for most countries to capture and turn over criminals within the borders to another country. That is why people bring up Russia and North Korea. Those are the two most likely countries that wouldn't. There are a few others, but not many. Even China which in general I wouldn't trust would in this case. If China did an attack like this it would be much more targeted and they wouldn't be looking for ransom money - See the attacks on the Iran nuclear program for example: attack a target that actually matters. (those attacks were probably US or Israel, but it is the type of thing China might do).

specialp 5y ago

They know that they can and will be found, and are running scared. In general ransomware works because it takes a lot of resources to find the criminals behind it. And generally there's not enough resources to do this. But once it hits a level where it creates a widespread national problem, it becomes more of an act of war. Then you get people involved that aren't just law enforcement and have tools that aren't available to law enforcement with large budgets.

ttul 5y ago
Not to mention diplomatic channels to apply pressure on local governments that may have previously lacked the impetus to do anything about these groups.
jl2718 5y ago
I don’t understand how ransom ware works at all. The address is known well in advance, so a miner knows they might face sanction of their own coins for including it in their block. Not worth it.
snypher 5y ago
Running scared though? I see this as the dash from 2nd plate to 3rd. If you're going to ditch your servers and wash your coins you might as well make it seem like you were compromised. I don't think there's any fear here as they surely must have anticipated the consequences.

sfotm 5y ago

I’m skeptical as well. They know they built up a little too much notoriety and want to exit the game, is my guess. A core set of people can live pretty comfortably off of the ransom here, though they’ll have a hard time laundering it.

stickfigure 5y ago

Agreed, except why bother pop up again? They just got a big fat payment of $5m. Plenty to split with a small team. It's a good time to cash out and disappear.

SavantIdiot 5y ago
Seriously! It's FIVE MILLION. That's "I don't ever have to work again" money. What is wrong with people! Probably they want Mercedes, and Rolexes, and Mont Blanc pens and all that showy consumer garbage.
- colechristensen 5y ago
  The median lifetime earnings in the US is 1.7 million, and that’s equivalent to... $20 an hour or so. 5 million is “never work again” money for a couple of people who want middle class incomes the rest of their lives... it is not really that much when spread over more than a few people.
  - showerst 5y ago
    Darkside is likely based in Russia, where lifetime median earnings are much lower.
    - jandrese 5y ago
      They're also going to lose a big chunk of that to money laundering losses. But since it is in Bitcoin it's probably going to appreciate over time. The problem is that if they fuck it up just once the record will be on the blockchain forever and they'll never be safe.
  - stickfigure 5y ago
    These people likely do not live in the US. Also, how big do you think the core team is? I would assume they're freezing out anyone who can't identify the culprits.
  - 5y ago

timdellinger 5y ago

It's plausible that this is all a scheme to evade capture. Disband the current organization, (get rid of a few people who you've wanted to jettison anyway), and then set up shop afresh elsewhere. It sends the message to whoever's looking for you that the whole thing has been burned to the ground and there's nothing to raid or seize or shut down.

bluGill 5y ago
Possible, but there is too much a chance that the cops already know who you are and just need to gather evidence in a form they can take to court. By shutting down they ensure that no more evidence is gathered. By starting a new organization they can't be sure that they aren't still being watched.

bluetwo 5y ago

Depends if the DOJ issues arrest warrants for the members in a couple weeks.

SavantIdiot 5y ago
Since they aren't in the US, it is probably more of a proactive step by the DOJ to build a case for sanctions. Assuming they know what country the perps are from, which doesn't seem all that clear.
- bluGill 5y ago
  There are only a handful of countries that won't accept the US arrest warrants and turn over whoever. A few countries will demand something first, but this means no death penalty, not something that is in anyway a big deal for the other country. It is semi-routine for most countries to capture and turn over criminals within the borders to another country. That is why people bring up Russia and North Korea. Those are the two most likely countries that wouldn't. There are a few others, but not many. Even China which in general I wouldn't trust would in this case. If China did an attack like this it would be much more targeted and they wouldn't be looking for ransom money - See the attacks on the Iran nuclear program for example: attack a target that actually matters. (those attacks were probably US or Israel, but it is the type of thing China might do).