34 ms·
How is the REvil gang outsourcing the risk? Aren't the things they're doing just as high-risk as the things the affiliates are doing?
by Thorrez 5y ago
How is the REvil gang outsourcing the risk? Aren't the things they're doing just as high-risk as the things the affiliates are doing?
- tjpnz 5y agoYour affiliate might be able to make a deal with a judge in exchange for you. How confident are the ringleaders in their anonymity?
- Thorrez 5y agoYep. And the affiliates might be government agents. Both ringleaders and affiliates need to take anonymity measures, so they seem equally vulnerable to me.
- snapetom 5y agoProblem is this isn't exactly like a street meeting between mafia thugs in New York in the 60's. There's no face to face contact for cops to monitor. There's no wires to record voices and tie into identities. Sure, there's meetings, but they're online and can be anonymized. Of course, it's not 100%, but it's a higher chance of success than say, wiretapping a phone.
- Thorrez 5y agoAll of those apply to both the affiliates and the ringleaders. Also, wiretapping a phone only captures future calls. A warrant against a website, or the website's hosting provider can provide message history, assuming it's not E2E encrypted. And it could even get the message history of every single user in one go if the site is e.g. hacked, or if there's a broad warrant against a crime website's hosting provider. We can see from this article that tons of these criminal websites get hacked, and then people like Brian Krebs can investigate the leaked databases to see info about the criminals' accounts.
- snapetom 5y agoThe gang themselves aren't doing the actual customer engagement (breaking in, phishing, etc.). The affiliates are. The affiliates are the ones themselves potentially exposing their IP address. REvil just provides the tools, training, and guidance.
- pohl 5y agocustomer engagement Is this a euphemism for victim engagement, or is there some other party playing the customer role that I'm not thinking of?
- stavros 5y agoREvil makes the malware, they sell it to criminals, and the criminals infect systems and take the payments for themselves.
- PeterisP 5y agoIIRC REvil does not sell the malware to criminals, they give the malware to criminals but hold some control over the decryption keys needed for the ransom to ensure that they get a share of it. I.e. it's truly an affiliate / revenue sharing system, not a sale of tools.
- stavros 5y agoAh, interesting. I guess that'd be the way to do it, though I wonder if they hold the payment keys themselves too, or if they get paid after the fact.
- Thorrez 5y agoThe ringleaders also risk their IP when they access any website, such as some crime forum to sell their malware. Crime forums regularly get hacked, and sometimes the databases have last logged in IP in them. Also, I'm not sure about crime forums, but other forums sometimes allow image embedding, either by a profile picture hotlink, or bbcode, or html, which can get the IP of everyone who views the page. Also, just by sending someone a link you can get that person's IP. Maybe DNS prefetching can get some info about the person even if the person doesn't click the link. Also whatever hosting provider they use to distribute the malware to the affiliates could end up leaking their IP.