2 ms·
You can imagine it just being easier to code indiscriminate attacks where they only review the results to pick who it is worth collecting the ransom from. Unen
by cma 5y ago
You can imagine it just being easier to code indiscriminate attacks where they only review the results to pick who it is worth collecting the ransom from.
Unencrypting for vicitims in the US that couldn't pay would just add more exposure risk to them of getting caught, so they would have no incentive to actually do it. It would take a large bit of money out of the system, but it seems like you need all countries to coordinate and that one country doing so on its own, enforcing a no pay out rule, won't have much effect on non-targeted attacks.
How many of these attacks are fully automated in the initial attack/encrypt phase vs. human operators explicitly working to more fully infiltrate a target?
- akiselev 5y ago> How many of these attacks are fully automated in the initial attack/encrypt phase vs. human operators explicitly working to more fully infiltrate a target? Given the effectiveness of social engineering in hacking's history, that's a very good question. I wouldn't be surprised if randomized attacks are used to create a "sales funnel" of high value targets with poor IT ops/outdated equipment/etc that can be exploited for big payouts. All it takes is a few hundred or thousand dollars to bribe a low level employee so the vast majority of the cost is likely in finding targets. Once they've identified a target, the exploitation process is probably mechanical.
- 0xdba 5y agoThey used to target individuals, but have moved to larger institutions with likely big insurance payouts. Schools, companies, government agencies.