3 ms·

> seem to point to ransomware activities being far more coordinated and "business-like" than they often get credit for. This is a business that actually provid

> seem to point to ransomware activities being far more coordinated and "business-like" than they often get credit for. This is a business that actually provides better support than a regular business. From conversations with friends in the Infragard side of this, and the agencies that collaborate, they have 24/7 English support available before and after payment, as well as decryption remote support if you can't get your files decrypted... there are also instances of refunds if they can't decrypt your files due to technical issues. Unlike regular businesses, support is a sales channel since it's the way to ensure you get paid so a lot of resources go to support activities in these "organizations".

mason55 5y ago
Yeah apparently in addition to their white label ransomware software, if you licensed their software you could also have DarkSide handle negotiations for you. 10%-25% of the ransom and in exchange you get people who have real experience handling the negotiations and have the infra in place already to remain anonymous while supporting 24/7 English language service.
- rsj_hn 5y ago
  Ransomware-As-A-Platform. I wonder if they got the criminal-underground equivalent of VC-funding, or if they have something like Y-combinator to fund innovative criminal approaches and promote networking -- like evil-Kirk from the mirror universe, there could be a Saul Graham with a mustache writing essays about unlocking value and what you are not allowed to say in the ransomware community.
  - vmception 5y ago
    There is investment infrastructure. Mostly informal and enforced via smart contract and multisignature transactions. Organized on forums and chat rooms. Not much capital is needed though and the affiliate and licensing model is better, which also just means an address is hardcoded that splits payment, or a server controls the private key (or master private key for infinite unique address creation) to addresses and automatically splits received payments to the RaaS service I get that was supposed to be a joke, its exactly the same or even more streamlined than the licit economy. There is no major distinction except the kinds of “risk factors” one might list.
  - meowface 5y ago
    From my (admittedly shallow) understanding, all of that does kind of exist and has for at least a few years, now. It's also existed for longer for the DDoS-as-a-Service industry. Most of it's in Russian and takes place on private and semi-private Russian forums and chat rooms/groups. There's definitely a hierarchy to it. Any particular group may not necessarily develop or own the software or infrastructure they're using. You can probably liken it to drug markets, where there are some top-level central players and many tiers below that make up the whole supply and distribution chain. (And potentially, the absolute top-level / "The Commission" may be certain elements of certain nations' governments, in some cases, or at least closely associated with them, which further complicates matters.) You might find this 2020 interview with a ransomware operator interesting: https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/481/original/010421_LockBit_Interview.pdf https://talos-intelligence-site.s3.amazonaws.com/production/...
gimmeThaBeet 5y ago
> there are also instances of refunds if they can't decrypt your files due to technical issues. I would like to hear more about this, that sounds kind of hilarious. "Ah, apologies, we'll get that back to you within 3 business days. Have a nice day, I hope you had backups"
- vmception 5y ago
  That’s exactly how it is and has been for a very long time (half decade or more).
jabroni_salad 5y ago
Maybe with Darkside, but they account for a very small amount of activity. Back in the Gandcrab days, anyone with a credit card could fire up their own tenancy, and they mostly sucked at it. They would lose the decryption keys or send non functional decryptors. They were not interested in talking and just thought the RaaS platform would be a passive income for them. I mostly dont do ransomware housecalls anymore, but my teammates tell me the situation has mostly not improved.
munificent 5y ago
> This is a business that actually provides better support than a regular business. The thing I find fascinating from a sociology perspective about ransomware is that they have to. To be a successful ransomware company, you have to simultaneously be: 1. Completely immoral enough to attack companies, hold their data ransom and potentially put them out of business and reveal the private details of thousands of people. 2. Create enough trust in the company you attacked that they believe you will give the data back once you pay them. It is crazy that they are psychologically savvy enough to simultaneously attain those directly conflicting goals.
- dv_dt 5y ago
  There are many businesses operating in on the legal side of things which I find immoral, but would trust to act consistently in certain ways…
- cmeacham98 5y ago
  I don't think these goals are very conflicting. It's not hard to imagine a criminal unwilling to lie and/or break their promise, as a matter of fact it is a common trope in works of fiction (https://tvtropes.org/pmwiki/pmwiki.php/Main/IGaveMyWord https://tvtropes.org/pmwiki/pmwiki.php/Main/IGaveMyWord).
- larksimian 5y ago
  In a cynical telling this is how you start a government or any organization with a monopoly on violence, ala mafia. First you make it clear that you can cause damage, then you make it clear that tax payers are safe. The next step for ransomware companies is to offer cyber security services, whether you want them or not. We've hacked you. We fixed your crappy unpatched software, if you try to remove us you lose all your data, so now we're your cyber security partners.
  - ChainOfFools 5y ago
    or any self-identified 'disruptive' business model really. step 1: "join my disruptor gang and we'll protect your lifestyle/income/status in exchange for tribute, or at least not becoming a disruptee yourself." step 2: end up eventually recapitulating the exact same system you disrupted, but now you get all the spoils of the incumbent power
technion 5y ago
I can tell you that on the same day I opened a support case with both a ransomware operator and Microsoft premier support. One of those vendors took my money went dark. Guess which one?
manigandham 5y ago
That's not support. You're not a customer. They're not providing any value. This isn't some glorified version of business, it's just organized crime. They're available for their interests, not yours. They're actively robbing you and will be highly available to keep things moving efficiently, the same way physical bank robbers used to make sure staff were comfortable enough to open the safe and provide cover.
- WrtCdEvrydy 5y ago
  Of course I am... if I'm paying 5 million dollars to someone, I'm a customer. What level of support do you get for a 5 million dollar AWS budget?
  - manigandham 5y ago
    If someone kidnaps your family member and asks you to pay $5M, do you think you're a customer now? A customer willingly pays to get value in return. Having your resources stolen (even with the option to choose between data or money) just makes you a victim. $5M on AWS gets you $5M of services. If they didn't have to actually provide anything then they could have an entire team to talk to you 24hrs a day. But these comparisons are beyond ridiculous and you know it.
    - WrtCdEvrydy 5y ago
      > $5M on AWS gets you $5M of services. $5M on ransomware may have saved you either $10k or $10M on security before you had to pay out.
      - manigandham 5y ago
        It's impossible to have saved anything when you've been stolen from.
dannyw 5y ago
Yeah. If you're dealing with a ransomware org with a reputation, you can pretty much be assured you're getting your files back minutes after paying, or a refund and apology.

mason55 5y ago

Yeah apparently in addition to their white label ransomware software, if you licensed their software you could also have DarkSide handle negotiations for you. 10%-25% of the ransom and in exchange you get people who have real experience handling the negotiations and have the infra in place already to remain anonymous while supporting 24/7 English language service.

rsj_hn 5y ago
Ransomware-As-A-Platform. I wonder if they got the criminal-underground equivalent of VC-funding, or if they have something like Y-combinator to fund innovative criminal approaches and promote networking -- like evil-Kirk from the mirror universe, there could be a Saul Graham with a mustache writing essays about unlocking value and what you are not allowed to say in the ransomware community.
- vmception 5y ago
  There is investment infrastructure. Mostly informal and enforced via smart contract and multisignature transactions. Organized on forums and chat rooms. Not much capital is needed though and the affiliate and licensing model is better, which also just means an address is hardcoded that splits payment, or a server controls the private key (or master private key for infinite unique address creation) to addresses and automatically splits received payments to the RaaS service I get that was supposed to be a joke, its exactly the same or even more streamlined than the licit economy. There is no major distinction except the kinds of “risk factors” one might list.
- meowface 5y ago
  From my (admittedly shallow) understanding, all of that does kind of exist and has for at least a few years, now. It's also existed for longer for the DDoS-as-a-Service industry. Most of it's in Russian and takes place on private and semi-private Russian forums and chat rooms/groups. There's definitely a hierarchy to it. Any particular group may not necessarily develop or own the software or infrastructure they're using. You can probably liken it to drug markets, where there are some top-level central players and many tiers below that make up the whole supply and distribution chain. (And potentially, the absolute top-level / "The Commission" may be certain elements of certain nations' governments, in some cases, or at least closely associated with them, which further complicates matters.) You might find this 2020 interview with a ransomware operator interesting: https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/481/original/010421_LockBit_Interview.pdf https://talos-intelligence-site.s3.amazonaws.com/production/...

gimmeThaBeet 5y ago

> there are also instances of refunds if they can't decrypt your files due to technical issues. I would like to hear more about this, that sounds kind of hilarious. "Ah, apologies, we'll get that back to you within 3 business days. Have a nice day, I hope you had backups"

vmception 5y ago
That’s exactly how it is and has been for a very long time (half decade or more).

jabroni_salad 5y ago

Maybe with Darkside, but they account for a very small amount of activity. Back in the Gandcrab days, anyone with a credit card could fire up their own tenancy, and they mostly sucked at it. They would lose the decryption keys or send non functional decryptors. They were not interested in talking and just thought the RaaS platform would be a passive income for them. I mostly dont do ransomware housecalls anymore, but my teammates tell me the situation has mostly not improved.

munificent 5y ago

> This is a business that actually provides better support than a regular business. The thing I find fascinating from a sociology perspective about ransomware is that they have to. To be a successful ransomware company, you have to simultaneously be: 1. Completely immoral enough to attack companies, hold their data ransom and potentially put them out of business and reveal the private details of thousands of people. 2. Create enough trust in the company you attacked that they believe you will give the data back once you pay them. It is crazy that they are psychologically savvy enough to simultaneously attain those directly conflicting goals.

dv_dt 5y ago
There are many businesses operating in on the legal side of things which I find immoral, but would trust to act consistently in certain ways…
cmeacham98 5y ago
I don't think these goals are very conflicting. It's not hard to imagine a criminal unwilling to lie and/or break their promise, as a matter of fact it is a common trope in works of fiction (https://tvtropes.org/pmwiki/pmwiki.php/Main/IGaveMyWord https://tvtropes.org/pmwiki/pmwiki.php/Main/IGaveMyWord).
larksimian 5y ago
In a cynical telling this is how you start a government or any organization with a monopoly on violence, ala mafia. First you make it clear that you can cause damage, then you make it clear that tax payers are safe. The next step for ransomware companies is to offer cyber security services, whether you want them or not. We've hacked you. We fixed your crappy unpatched software, if you try to remove us you lose all your data, so now we're your cyber security partners.
- ChainOfFools 5y ago
  or any self-identified 'disruptive' business model really. step 1: "join my disruptor gang and we'll protect your lifestyle/income/status in exchange for tribute, or at least not becoming a disruptee yourself." step 2: end up eventually recapitulating the exact same system you disrupted, but now you get all the spoils of the incumbent power

technion 5y ago

I can tell you that on the same day I opened a support case with both a ransomware operator and Microsoft premier support. One of those vendors took my money went dark. Guess which one?

manigandham 5y ago

That's not support. You're not a customer. They're not providing any value. This isn't some glorified version of business, it's just organized crime. They're available for their interests, not yours. They're actively robbing you and will be highly available to keep things moving efficiently, the same way physical bank robbers used to make sure staff were comfortable enough to open the safe and provide cover.

WrtCdEvrydy 5y ago
Of course I am... if I'm paying 5 million dollars to someone, I'm a customer. What level of support do you get for a 5 million dollar AWS budget?
- manigandham 5y ago
  If someone kidnaps your family member and asks you to pay $5M, do you think you're a customer now? A customer willingly pays to get value in return. Having your resources stolen (even with the option to choose between data or money) just makes you a victim. $5M on AWS gets you $5M of services. If they didn't have to actually provide anything then they could have an entire team to talk to you 24hrs a day. But these comparisons are beyond ridiculous and you know it.
  - WrtCdEvrydy 5y ago
    > $5M on AWS gets you $5M of services. $5M on ransomware may have saved you either $10k or $10M on security before you had to pay out.
    - manigandham 5y ago
      It's impossible to have saved anything when you've been stolen from.

dannyw 5y ago

Yeah. If you're dealing with a ransomware org with a reputation, you can pretty much be assured you're getting your files back minutes after paying, or a refund and apology.