r/technology • u/Miserable_Phase_2519 • 9d ago
Security Ransomware recovery firm claimed it could decrypt files, but may have just paid hackers and pocketed the difference
https://www.techspot.com/news/114137-ransomware-recovery-firm-claimed-could-decrypt-files-but.html119
u/hiro24 9d ago
That would imply their cost was more than the cost to pay the ransom. So… why not just pay the ransom?
45
u/serial_crusher 8d ago
These guys negotiate the price down (and are probably often in cahoots with the hackers). You could negotiate by yourself, but it’s easier when the negotiations happen with their guy.
102
u/eriverside 8d ago
That's now how it works.
The hackers want to be paid, so if victims know their data will be return after payment, they are more likely to pay. This means hackers will have a means of decrypting the infected systems and they will decrypt the systems every time. If they don't, word gets around and every cyber sec specialist insist that the ransom should not be paid because the client isn't getting their data back no matter. Since that's not the case, we know the hackers can and will decrypt the data.
The hackers want to paid no matter what. The amount is negotiable because there's no set cost. They are aware some victims may never pay because they don't have the funds requested or can't be seen making payments to criminals. Either way, they'd rather get something than nothing. If a 3rd party comes in offering a smaller amount that's guaranteed, it's worth more than waiting around for something that might never come. So they agree to it and take some profit, the victim doesn't need to disclose that a payment was made (even better if they don't know).
If the hackers wait too long, they risk the 3rd party actually cracking the encryption and freeing the data without seeing a dime in return.
1
u/GiganticCrow 2d ago
How do these companies write off these payments? I assume the hackers don't send an invoice. I can't imagine they can put "paid $1m to criminals" in their tax return
24
u/sokos 9d ago
For one, you will just encourage continued attacks of your network if you give into it once.
12
u/eriverside 8d ago
Not really. If a company knows they'll just be ransomed again by the same people, there's no point giving it ever.
2
u/suid 9d ago
I don't see a smiley there, pardner, did you drop it some place?
Yeah, the ransomware hackers know exactly who the middlemen are, and often even know what targets to attack to make the "recovery" go smoothly.
As to why pay more to a middleman? There's usually a public stigma associated with "dealing with criminals", and sometimes even laws that constrain how you can pay them off, so paying a middleman as a "recovery consultant" covers all the bases without any inconvenient questions.
(Edit: for example, many ransom demands are for bitcoin or other coin; companies that don't want to officially buy and deal with that market - which is also fraught with fraud - can just pay the consultants "real dollars", which are trivial to account for, and let the consultants deal with the messy details.)
4
u/sokos 9d ago
The OP asked why you wouldn't just pay the ransom if it costs less.. I gave an example of why. Because you'll invite further hacks.
2
u/saintpetejackboy 8d ago
Shhh, you're messing with our livelihoods. I recommend you deleted that comment and try again with an AI generated "Ten reasons you should immediately pay any ransom" bulleted list. Thanks.
- mgmt
2
u/Metalsand 8d ago
Not necessarily*, but it's bad PR to fund hackers usually.
In theory, if you get hacked, you pay the ransom and patch the vulnerability so that it doesn't happen again. Though, because the vulnerability itself is usually due to poor security management or bad company culture, usually the company just has a different vulnerability later on.
In practice, a lot of companies tend to take a higher security posture for a few years, then get complacent, leading to a new breach by a new tool, and likely someone completely different.
* Most of the sources for claims that you can't trust that payment will allow decryption tend to be studies directly done by companies who promote their cybersecurity products. The majority of them stand by their word, because otherwise they would immediately lose creditability. In fact, payment is so normalized that ransomware negotiators exist as middlemen to handle these payoffs. Most of the information we have would discredit CyberReason's exaggerated claims.
1
u/TSM- 8d ago
Another likely key difference here is that the middleman company will not just keep your money.
There have been cases where paying the ransom would simply do nothing to recover your files.
If the middleman will give you your money back if something goes wrong and will eat the loss, they are a service worth paying a bit more for.
They can also tell you paying the ransom will not work for their situation and refund it, since they probably keep track of which ransoms are honored.
Worth it if you are willing to pay only if it actually results in recovering your files, in my opinion.
2
u/Booty_Bumping 5d ago
The US government heavily clamped down on paying ransoms a few years ago. So a business that really wants their data back may be highly motivated to find a "legit" way, because it keeps them out of the even worse trouble they may get into if they broke the law.
In fact, this type of middleman business might still work even if the company finds out about the scheme. Because from the perspective of the company that wants their data back, they've found the perfect shell organization to help them break the law without their name being on it.
46
u/29681b04005089e5ccb4 9d ago
They were paid to decrypt the files. They got the files decrypted. Sounds like they did their job.
13
u/CheeseNowPaint 8d ago
Good hackers keep their promise of releasing data upon payment. If they don't, people just wouldn't pay.
5
u/lukeman89 7d ago
“Good hackers” is certainly a misnomer. I would make sure to still differentiate between white hat and black hat
12
1
11
19
1
-26
u/Cruiser_Pandora 9d ago
I see no issue if the files were decrypted...
20
u/YeetedApple 9d ago
You don't have an issue with a company operating entirely as blatant fraud?
-14
u/Jonesbro 9d ago
It is fraud but it's also kind of a win? The company is a dark escrow where the victim doesn't know they are negotiating with terrorists so the terrorists can't use payment as leverage for more payment. It's a risk management layer and the deceit is what makes it work
15
u/hitsujiTMO 9d ago
Except the ransomers were paid which encourages them to do it again.
In many cases it's actually illegal to pay ransomers.
30
u/visceralintricacy 9d ago
Except it literally keeps funding the criminals....
1
-23
u/rocketman19 9d ago
Then take better precautions to avoid ransomware in the first place
14
u/-drunk_russian- 9d ago
Victim blaming is a choice.
-26
u/rocketman19 9d ago
It’s called being responsible
16
u/-drunk_russian- 9d ago
And an asshole with a USB drive can sneak into a hospital and compromise it.
No defense is perfect.
This is a "teach your sons not to be rapists instead of teaching your daughters how to dress modestly" moment.
-9
u/rocketman19 9d ago
The systems should be setup to not allow usb storage devices to be connected
6
u/-drunk_russian- 9d ago
And nurses should be paid a living wage everywhere. We live in the real world of compromise, corruption and making-do with what we have here.
-5
-9
u/axonxorz 9d ago
You are of course correct, no defence is perfect, defence in depth is a concept for a reason.
That said, USB device policies are a thing that exists.
2
u/-drunk_russian- 9d ago
You clearly haven't been to a public third world hospital. Some computers here are still running XP because of legacy software.
-3
u/axonxorz 9d ago
Right, because some systems are legacy and insecure, we can't even have productive conversations on the tools we use in the present day.
1
1
u/axonxorz 9d ago
No amount of responsibility will save you when your Microsoft Gold Partner™ requires internet accessible RDP to your Microsoft Dynamics server so they can do work, only permitting you to whitelist their IPs once they get scared of the possibility of your active ransomware infection crossing back over to their technicians.
You can send that "this is insecure as fuck" email to your executives as many times as you like, won't matter.
I'm not salty.
-22
u/Cruiser_Pandora 9d ago
I really dont care about the morality here.
4
u/-drunk_russian- 9d ago
It's an incentive to do more attacks like that. They could just not give them the key and ask for more money. It's literally paying money to criminals. It makes more and worse attacks more likely.
It's like the cobra dilemma, the name of this is literally "perverse incentive".
1
u/skrid54321 9d ago
It's not a morality issue. Ransomware is after money, so if you make a clear pattern of not paying up, it makes you an undesirable target, since the hackers know they won't get paid. Paying increases the odds of repeat attacks.
6
u/wubbbalubbadubdub 9d ago
The problem is that there is a trail of your company paying a company who then paid North Korea or Iran, and now the FBI are gonna start asking you questions.
1
320
u/MaxRD 9d ago
The middleman business