3 ms·

That doesn't make a lot of sense. If they thought that they could take a golden exit, they wouldn't be continuing to setup the business again under new rules to

That doesn't make a lot of sense. If they thought that they could take a golden exit, they wouldn't be continuing to setup the business again under new rules to avoid government scrutiny. They'd just take the money and disappear. The fact that they are continuing means that they want to continue the business. And if they are doing that, then why would they suddenly break all existing contracts? Surely that would ruin a lot of their reputation, and hurt their ability to get clients. Can you imagine what kind of amazing free PR they would be getting if they continued the attack? Surely other criminals would be amazed at their ability to resist counter hacks. That would mean more clients and more money. No, no. While I'm sure there is theft in the ransomware world, I don't think you make this kind of play from a position of strength.

jtbayly 5y ago
If they are scared but want to continue the "business" then they are stuck between a rock and a hard place. Getting hacked is a nice "out" from their contracts without losing money to reimbursements. Remember, they won't be accepting as wide a clientele anymore, so presumably a fair bit of that money they wouldn't get back from re-signups. On the flip side, they now have extra money they can use for incentives to the clients they really want to sign back up. So, I think there's a good case to be made that this is the best course of action, given they are scared but don't want to quit entirely (which seems clear). It isn't nearly as bad a hit to their reputation as just taking the money and running, so they don't have to hide their identities and rebuild new ones to start over in crime, and they don't lose nearly as much money, and they probably won't lose the clients they actually care about.