4 ms·
They're mostly decent about getting the systems unlocked after you pay. The incentive for these groups is that if they become known as unable or unwilling to ge
by rtkwe 2y ago
They're mostly decent about getting the systems unlocked after you pay. The incentive for these groups is that if they become known as unable or unwilling to get you your systems back they're far less likely to get paid. A few years back I read an article talking about this exact problem where the groups were fairly active and responsive so that their victims are more likely to actually pay.
- teqsun 2y agothat's my question: if you were the ransomee, how do you establish that you're working with a "reliable" ransom group? Is there a BBB for ransom groups? If so, how do you establish that the ransom group is actually the group with the good reputation? I guess I'm intrigued by how you achieve all that when you're talking about the perpetrator of a crime that is obfuscating their identity.
- rtkwe 2y agoVerification is an issue but if places do pay and they can't decrypt the victim is likely to talk about it. Also for this reason, like others have said, the ransomware tools have trial decrypts built in or the ability to generate a program/key that decrypt some of the files so that the victims can see that the attackers have the ability to decrypt some of their files. That requires zero trust and is more difficult than just having a single key that encrypts or decrypts everything.
- yardstick 2y agoThey’ll be able to prove they can decrypt a few of your files first. That’s generally enough for most people to move forward with paying the ransom. If they can prove they can decrypt, they have very little to lose by not releasing the decryption key after being paid.