3 ms·

Are these rational actors who would even care about the collective long term effects? Eg the same could be said for drug dealers ripping off their customers, bu

by cjaybo 3y ago

Are these rational actors who would even care about the collective long term effects? Eg the same could be said for drug dealers ripping off their customers, but that still happens daily because they often prioritize short term self interest over long term/collective concerns.

NegativeK 3y ago
Many ransomware groups have learned that acting more like a business results in higher payouts. They're not all going to do it, but they have payment portals, negotiators using professional language, attempts to maintain reputation, etc. Obviously this behavior doesn't apply to all of them, but it's a clear effort by some of them to immediately appear more palatable to random IT worker, the execs, and the lawyers who are watching the who process play out. And it also lines up with the fact that ransomware groups have freaking HR departments to handle their employees.
galangalalgol 3y ago
And Boeing could never know Airbus hadn't been given the opportunity to buy the data, as they would never disclose that.
rtkwe 3y ago
It's not consistent across the broad category of criminal for sure but they're probably not the most long term oriented people as a rule now. Initial groups were more, for a lack of a better word, professional about the process with some groups even having a kind of tech support for helping victims to make sure people would believe they'd get their files back if they paid. Better preparation on the corporate side and a democratization of the tools to perform it has lead to some changes it looks like where ransomware groups didn't exfiltrate often before because it wasn't their main playbook.
csydas 3y ago
Yes, mostly because the other actors are notoriously vengeful and petty; ransomware gangs, dark markets, etc, they don't just register complaints with each other, they typically look to ensure the bad actors are removed from the space entirely. regarding drug dealers, I wouldn't consider it a good comparison. the actions of one dealer typically doesn't affect others, they're just not that connected beyond professional recognition/courtesy. If dealer A is shorting their customers, dealer B absolutely wouldn't care as why would they? they have no relationship, and it'd probably mean the customers go to dealer B instead. business will continue as usual even if one bad actor is doing shitty stuff to their customers. with ransomware that is not the case -- if public opinion overwhelmingly tells there's no sense in paying because the ransomware gangs never follow their word, that affects all the gangs, not just the bad actor. the gangs already have a hard enough argument to make as to why the targets should pay so anything that frustrates that further is frowned upon.

by cjaybo 3y ago

NegativeK 3y ago

Many ransomware groups have learned that acting more like a business results in higher payouts. They're not all going to do it, but they have payment portals, negotiators using professional language, attempts to maintain reputation, etc. Obviously this behavior doesn't apply to all of them, but it's a clear effort by some of them to immediately appear more palatable to random IT worker, the execs, and the lawyers who are watching the who process play out. And it also lines up with the fact that ransomware groups have freaking HR departments to handle their employees.

galangalalgol 3y ago

And Boeing could never know Airbus hadn't been given the opportunity to buy the data, as they would never disclose that.

rtkwe 3y ago

It's not consistent across the broad category of criminal for sure but they're probably not the most long term oriented people as a rule now. Initial groups were more, for a lack of a better word, professional about the process with some groups even having a kind of tech support for helping victims to make sure people would believe they'd get their files back if they paid. Better preparation on the corporate side and a democratization of the tools to perform it has lead to some changes it looks like where ransomware groups didn't exfiltrate often before because it wasn't their main playbook.

csydas 3y ago

Yes, mostly because the other actors are notoriously vengeful and petty; ransomware gangs, dark markets, etc, they don't just register complaints with each other, they typically look to ensure the bad actors are removed from the space entirely. regarding drug dealers, I wouldn't consider it a good comparison. the actions of one dealer typically doesn't affect others, they're just not that connected beyond professional recognition/courtesy. If dealer A is shorting their customers, dealer B absolutely wouldn't care as why would they? they have no relationship, and it'd probably mean the customers go to dealer B instead. business will continue as usual even if one bad actor is doing shitty stuff to their customers. with ransomware that is not the case -- if public opinion overwhelmingly tells there's no sense in paying because the ransomware gangs never follow their word, that affects all the gangs, not just the bad actor. the gangs already have a hard enough argument to make as to why the targets should pay so anything that frustrates that further is frowned upon.