5 ms·

So why are ransomware hackers never prosecuted?

by nprz 5y ago

khuey 5y ago
Because they live and operate in jurisdictions without extradition treaties.
- nprz 5y ago
  So they might as well just ask for their ransom via a wire transfer or paypal? Since their identity will be known anyway.
  - tylersmith 5y ago
    If ransomware used PayPal accounts or bank numbers those payments would quickly start being censored to cut off their payment rails. The value of crypto is all rooted in censorship resistance, not anonymity.
    - nprz 5y ago
      Wouldn't it have to be an agency in their own jurisdiction that would prevent the hacker from accessing banking services? They would make an effort to shut down the hackers bank account but not prosecute them?
      - khuey 5y ago
        The pressure point in the traditional financial system is not the Russian authorities cutting off the Russian hacker from a Russian bank, it's SWIFT cutting off the Russian bank from the global financial system.
amalcon 5y ago
Because they typically operate out of jurisdictions that don't feel like prosecuting them.
- nprz 5y ago
  Why not just ask for a paypal or a wire transfer then? If they don't care about revealing their identity?
  - nitrogen 5y ago
    Those are usually easily reversible.
CamelCaseName 5y ago
If there's one thing I've learned, it's that illegality is irrelevant. Only what laws are enforced, and how quickly they are enforced, matters.
gzer0 5y ago
Usually it involves conversion of illegally gained assets into untraceable cryptocurrencies such as XMR (Monero) and then subsequent funneling and conversion of those assets back into USD via offshore exchanges. IRS is offering $625,000 USD to anyone that can crack the Monero algorithm [1]. [1] https://www.forbes.com/sites/kellyphillipserb/2020/09/14/irs-will-pay-up-to-625000-if-you-can-crack-monero-other-privacy-coins/?sh=5155f02785cc https://www.forbes.com/sites/kellyphillipserb/2020/09/14/irs...
- fabianhjr 5y ago
  > conversion of those assets back into USD via offshore exchanges. They would probably not exchange into USD, there are plenty of other currencies and they would probably favor a local currency.
tablespoon 5y ago
> So why are ransomware hackers never prosecuted? Because they're typically based in Russia, and Russia has a policy that it will not prosecute its citizens for computer crimes unless they perpetrated them against Russians or Russian organizations. My understanding is most ransomware has code to detect Russian computers (e.g. by checking localization settings), and will refuse to run if it finds itself on one for that reason. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...
- nprz 5y ago
  So why not just send the payment to a Russian bank?
  - tablespoon 5y ago
    > So why not just send the payment to a Russian bank? I don't know, I'm not a Russian in the ransomware business. But I speculate that doing it that way might be so blatant and inconvenient to the Russian government that it might get the policy that protects them changed. Also, I'd imagine any bank that accepts such payments would quickly get itself blacklisted. This stuff isn't actually binary, so it's not smart to take it to the limit.
  - zaphar 5y ago
    Because Russian banks need to be capable of transacting with American banks and directly receiving money that is Ransom Payment related is a bad business decision.
    - nprz 5y ago
      So you're saying sending money to a bitcoin address would help obscure the identity of the receiver?
      - zaphar 5y ago
        No I'm saying a Russian bank probably doesn't look past the deposit. But if the deposit comes from America then an American bank will ask for it back when the US govt tells it to and then the bank will do so because it's good business. So I would imagine most ransomware gangs just keep the money in bitcoin and only pull out what they need to when they need to.
meowface 5y ago
Because trackable doesn't mean "always trackable to a real human identity who's the original source". Bitcoin transactions are trivial for anyone to track, since everything is recorded on the public blockchain, but you can't necessarily follow the trail to the true culprit even if you're law enforcement. Especially if there are non-cooperative entities in the chain who are completely outside of your jurisdiction. Though, the true answer to your actual question is what the other commenter said: it's mainly due to the Russian government turning a blind eye to it as long as they don't target Russian/ex-USSR citizens. So even if you do know a ransomware operator's full name and home address and everything else you can possibly know about them, you can't do anything about it besides hope they leave the country and try to catch them then.

So why are ransomware hackers never prosecuted?

by nprz 5y ago

So why are ransomware hackers never prosecuted?

khuey 5y ago

Because they live and operate in jurisdictions without extradition treaties.

nprz 5y ago
So they might as well just ask for their ransom via a wire transfer or paypal? Since their identity will be known anyway.
- tylersmith 5y ago
  If ransomware used PayPal accounts or bank numbers those payments would quickly start being censored to cut off their payment rails. The value of crypto is all rooted in censorship resistance, not anonymity.
  - nprz 5y ago
    Wouldn't it have to be an agency in their own jurisdiction that would prevent the hacker from accessing banking services? They would make an effort to shut down the hackers bank account but not prosecute them?
    - khuey 5y ago
      The pressure point in the traditional financial system is not the Russian authorities cutting off the Russian hacker from a Russian bank, it's SWIFT cutting off the Russian bank from the global financial system.

amalcon 5y ago

Because they typically operate out of jurisdictions that don't feel like prosecuting them.

nprz 5y ago
Why not just ask for a paypal or a wire transfer then? If they don't care about revealing their identity?
- nitrogen 5y ago
  Those are usually easily reversible.

CamelCaseName 5y ago

If there's one thing I've learned, it's that illegality is irrelevant. Only what laws are enforced, and how quickly they are enforced, matters.

gzer0 5y ago

Usually it involves conversion of illegally gained assets into untraceable cryptocurrencies such as XMR (Monero) and then subsequent funneling and conversion of those assets back into USD via offshore exchanges. IRS is offering $625,000 USD to anyone that can crack the Monero algorithm [1]. [1] https://www.forbes.com/sites/kellyphillipserb/2020/09/14/irs-will-pay-up-to-625000-if-you-can-crack-monero-other-privacy-coins/?sh=5155f02785cc https://www.forbes.com/sites/kellyphillipserb/2020/09/14/irs...

fabianhjr 5y ago
> conversion of those assets back into USD via offshore exchanges. They would probably not exchange into USD, there are plenty of other currencies and they would probably favor a local currency.

tablespoon 5y ago

> So why are ransomware hackers never prosecuted? Because they're typically based in Russia, and Russia has a policy that it will not prosecute its citizens for computer crimes unless they perpetrated them against Russians or Russian organizations. My understanding is most ransomware has code to detect Russian computers (e.g. by checking localization settings), and will refuse to run if it finds itself on one for that reason. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

nprz 5y ago
So why not just send the payment to a Russian bank?
- tablespoon 5y ago
  > So why not just send the payment to a Russian bank? I don't know, I'm not a Russian in the ransomware business. But I speculate that doing it that way might be so blatant and inconvenient to the Russian government that it might get the policy that protects them changed. Also, I'd imagine any bank that accepts such payments would quickly get itself blacklisted. This stuff isn't actually binary, so it's not smart to take it to the limit.
- zaphar 5y ago
  Because Russian banks need to be capable of transacting with American banks and directly receiving money that is Ransom Payment related is a bad business decision.
  - nprz 5y ago
    So you're saying sending money to a bitcoin address would help obscure the identity of the receiver?
    - zaphar 5y ago
      No I'm saying a Russian bank probably doesn't look past the deposit. But if the deposit comes from America then an American bank will ask for it back when the US govt tells it to and then the bank will do so because it's good business. So I would imagine most ransomware gangs just keep the money in bitcoin and only pull out what they need to when they need to.

meowface 5y ago

Because trackable doesn't mean "always trackable to a real human identity who's the original source". Bitcoin transactions are trivial for anyone to track, since everything is recorded on the public blockchain, but you can't necessarily follow the trail to the true culprit even if you're law enforcement. Especially if there are non-cooperative entities in the chain who are completely outside of your jurisdiction. Though, the true answer to your actual question is what the other commenter said: it's mainly due to the Russian government turning a blind eye to it as long as they don't target Russian/ex-USSR citizens. So even if you do know a ransomware operator's full name and home address and everything else you can possibly know about them, you can't do anything about it besides hope they leave the country and try to catch them then.