6 ms·
The most important line: > 80% of organizations that paid the ransom were hit by a second attack, and almost half were hit by the same threat group. The same
by spywaregorilla 5y ago
The most important line:
> 80% of organizations that paid the ransom were hit by a second attack, and almost half were hit by the same threat group.
The same group!
- tyingq 5y agoMakes sense to me. From what I've read, it's pretty clear the ransom payment is for a one-time ability to get your data back. It's not advertised as some sort of permanent opt-out.
- judge2020 5y agoAlthough I think false advertising would be the least of their worries if they decided to do it.
- cdstyh 5y agoMakes more sense if the group offered a subscription model for decrypting files encrypted by that group. Then you wouldn't have to keep paying the big lump sum.
- rossdavidh 5y ago...and if you pay for our Premium Level Service, we'll secure your systems against other criminal enterprises as well!
- mywittyname 5y agoWhat Hackers Can Learn From The Sopranos.
- weare138 5y agoThat's a nice network you have there. It would be ashamed if something happened to it if you know what I mean.
- vntok 5y agoSome groups will actually tell you how they got in and help you patch your systems. Some groups will hack you AND also uninstall viruses emanating from other groups, or they will hack you and patch other flaws so that other malwares cannot take their spot. It's all game theory.
- tyingq 5y agoA referral revenue sharing program for jaded employees would probably do well also.
- dylan604 5y agoEveryone knows that once you find a loose slots machine, you keeping playing it.
- jessaustin 5y agoYou might come back next week, but if it just jackpotted it's empty right now.
- dylan604 5y agoThat's so 1980s! Now, they update the balance on your Player's Card.
- southeastern 5y agoNot if the slot machine had an insurance company payout for them
- denton-scratch 5y agoI think it is, actually. Well, not advertised; but these big ransoms, they can be negotiated. And one of the victim company's requirements will be that if I pay, then you agree to leave me alone. I think these negotiations are fine, if you're just buying time to gather your backups; I've assumed the payouts were made by insurance companies, so go ahead - buy a zero-value promise from a gang of crooks, if you want. But your org has been rooted (at best, you can't prove it hasn't). Compromised systems can't be really be cleaned, they have to be reinstalled from scratch, if you want to have confidence in them. And an attack can be stored in data - which you're about to restore from backup. That's a problem I have faced, and I chose to ignore that threat. No choice - I didn't know how to address it then, and I still don't now. My half-baked opinions about ransomware are largely based on watching this documentary: https://www.bbc.co.uk/programmes/w172wx9056p6bd6 https://www.bbc.co.uk/programmes/w172wx9056p6bd6
- mumblemumble 5y ago> And one of the victim company's requirements will be that if I pay, then you agree to leave me alone. I'm curious how one would enforce that. From the fact that the ransom got paid in the first place, we can establish that there's no legal body that's able and willing to exercise any authority over the ransomware group. So it's not like you can sue them for breach of contract. Perhaps you can rely on the honor system? Though, given this is a group of professional extortionists we're talking about, if you choose to go that route, you may be at elevated risk of getting what you deserve.
- perlgeek 5y agoIt's a matter of reputation. If a ransomware group has a reputation of not actually delivering the unlock upon payment, or of re-infection shortly afterwards, the decision to pay them becomes harder to defend.
- mumblemumble 5y agoA sticky problem indeed. I'm sure their sock puppet budgets must run into the tens of dollars.
- meowface 5y agoDifferent groups have different policies. I believe some do actually add you to a whitelist if you pay and grant you at least a year or two before your immunity expires. (Maybe some do permanent whitelists? Not sure.)
- DaiPlusPlus 5y agoSomething something Norton Anti-Virus something.
- hiccuphippo 5y agoIt's right there in the small print. These companies sure know about that.
- abledon 5y agoWhere is the hacker's Honor... Cmon man
- mikewarot 5y agoIt went away when telling someone their system was broken stopped being treated a favor and started being treated as a crime. All the good guys shut up, and so you're left with the criminals who then exploit the flaws instead.
- ffhhj 5y agoComing soon: ransomware with subscription business model
- xrd 5y agoI up voted you for the lulz, but I'm actually unsure if this isn't the basic "legitimate" business model for everyone anyway.
- earleybird 5y agoI'm not so unsure - that's what make's it funny
- Scoundreller 5y ago“Up next on ‘You Won’t Believe It’, viruses were created by the antivirus industry”
- hindsightbias 5y agoThat's already a thing "SCHWIRTZ: What DarkSide does is they're a ransomware creator. So they create the program that is uploaded into a victim's computer system that locks down their data. But what they do is they basically contract out to these affiliates who are other hackers. And these are the people that are responsible for actually penetrating the victim's computer services. And what they do is operate basically on a subscription service. You, as an affiliate, can sign on to DarkSide services, in which case you get access to their malware, their ransomware to use for a fee that operates on a sliding scale depending upon the size of the ransom." https://www.npr.org/2021/06/10/1005093802/inner-workings-of-darkside-cybergang-reveal-its-run-like-any-other-business https://www.npr.org/2021/06/10/1005093802/inner-workings-of-...
- dragonwriter 5y agoI think they meant the ransom as a subscription service, not malware to franchisees as a service.
- joe_the_user 5y ago
- qyi 5y agoYou sure some ransomware crooks don't provide contracts to their clients?
- sslayer 5y agoIt makes you think about how many of those are inside jobs and/or compromised employees. In the case of colonial, it would seem highly likely given it was a credential compromise, but then again secure passwords are a known weakness
- nathias 5y agoThat group's name? The NSA.
- jdsully 5y ago"threat group" is odd phrasing, is it really the same actual group?
- ineedasername 5y agoI'm shocked at such unethical practices by the hackers. I expected better from a group of terrorists.
- snek_case 5y agoI'm kind of reminded of the mafia and their protection rackets. Obviously, you never could trust criminal organizations. At the same time, if you're a medium-sized corporation or small business and they have your important data, and you know you could pay to get it back, what do you do? I can imagine they really have some people by the balls, metaphorically speaking. They could drive you bankrupt. I hope the authorities find a way to go after these people, but it's obviously got to be difficult, because they might well be in China or Russia. It would take some international cooperation that's probably impossible right now. In the meantime... Switch to Linux, have a competent offsite backup strategy...?
- vlunkr 5y agoUnless the attackers revealed their exploit, it probably wasn't fixed and they just got in again the same way.
- Black101 5y agoI would leave a backdoor too if I was them (maybe not what they did)... I wonder how many paid for a 2nd and 3rd time...
- bostonsre 5y agoWonder what percentage of those that were hit had someone actively looking to get back in. Maybe 20% learned their lesson and improved their security. I wonder how many iterations of this will it take for most companies to learn that leaving your doors unlocked in a shady neighborhood/the internet is a bad idea.
- mysterydip 5y agoif it were me, I'd leave webshells or other backdoors to let myself back in if they didn't do proper cleanup. Especially if they paid, I have a "known good" customer.
- redisman 5y agoWhat would be the incentive not to? Honor among thieves? You know they’re vulnerable to the attack (the hard part?) so why not keep doing it until they shore up their defenses.
- hackflip 5y agoShort term you benefit from the second random. Long term, you may make people less likely to pay your ransoms.
- nhumrich 5y agoI mean, of course! This is like classic sales book play. Your previous "costumers" are almost always less effort to dollar than new prospects.
- AnimalMuppet 5y agoWere I an evil criminal, I'd include a backdoor in the restore image I gave them, so that I could attack the same people again.