3 ms·

> it kills the credibility of the ransomware group and they'll never get paid again I don't buy it. There's nothing to stop the group from rebranding themselve

> it kills the credibility of the ransomware group and they'll never get paid again I don't buy it. There's nothing to stop the group from rebranding themselves. The company has no proof nobody else got a copy of the data. And the group could simply hang onto the data, extort a bunch of money from other companies, then start back at the beginning and demand even more (knowing that the data is worth _at least_ what was already paid for it).

sofixa 3y ago
> I don't buy it. There's nothing to stop the group from rebranding themselves Apart from the fact that nobody would pay them if they have no reputation.
- raincole 3y ago
  Then how did they get "reputation" from the first place? Quite chicken and egg problem, right?
  - hot_gril 3y ago
    By starting with smaller ransoms. Same way any new business gets off the ground without rep, it's not easy or very profitable at first.
- tshaddox 3y ago
  Surely that can't be completely true. The reputation has to be bootstrapped somehow.
neodymiumphish 3y ago
New groups can't demand as much as the next. Also most of the big groups are RaaS (Ransomware as a Service), meaning their affiliates get approval to operate using LockBit's name, infrastructure, and software. If LockBit does something to taint their image in the media and among security organizations, then rebrands to avoid their negative history, forensics will still eventually tie their new name back to their old org, and victim's will have to decide whether they should trust that their data will be handled correctly after payment. As for re-victimizing old organizations, there's almost zero chance of that working. Most data is only sensitive for a certain time frame, long enough that they can make the proper notifications, change credentials, etc. Lastly, there still needs to be someone to download and abuse the data they leak. I've monitored ransomware torrents a few times and not observed any downloads completed over the course of a couple weeks following a data leak.

sofixa 3y ago

> I don't buy it. There's nothing to stop the group from rebranding themselves Apart from the fact that nobody would pay them if they have no reputation.

raincole 3y ago
Then how did they get "reputation" from the first place? Quite chicken and egg problem, right?
- hot_gril 3y ago
  By starting with smaller ransoms. Same way any new business gets off the ground without rep, it's not easy or very profitable at first.
tshaddox 3y ago
Surely that can't be completely true. The reputation has to be bootstrapped somehow.

neodymiumphish 3y ago

New groups can't demand as much as the next. Also most of the big groups are RaaS (Ransomware as a Service), meaning their affiliates get approval to operate using LockBit's name, infrastructure, and software. If LockBit does something to taint their image in the media and among security organizations, then rebrands to avoid their negative history, forensics will still eventually tie their new name back to their old org, and victim's will have to decide whether they should trust that their data will be handled correctly after payment. As for re-victimizing old organizations, there's almost zero chance of that working. Most data is only sensitive for a certain time frame, long enough that they can make the proper notifications, change credentials, etc. Lastly, there still needs to be someone to download and abuse the data they leak. I've monitored ransomware torrents a few times and not observed any downloads completed over the course of a couple weeks following a data leak.