Ransomware distributor gets hacked: A look behind the curtain

Two email accounts of a ransomware distributor were recently compromised. The analysis of these accounts gives an interesting “behind the curtain” view of a ransomware distributor. It appears that even malicious hackers use a bit of security advice.

The email account, cryptom27@yandex.com, which was used by the attacker behind the recent San Francisco Municipal Transportation Agency (SFMTA) ransomware incident, had an easily-guessable secret question. That allowed a security researcher to take over the account. The unidentified attacker had a backup email account, cryptom2016@yandex.com, that used the same secret question and was also compromised.

The analysis of these emails was reported by IT security blogger Brian Krebs, and it reveals a lot about ransomware distribution. First, the ransomware distributed by this attacker was not targeting specific organizations but was targeting an industry instead. The attacks focused primarily on U.S. construction and manufacturing firms. However, the attacker did not turn away business from those he had inadvertently exploited while launching the attack. The attacker also used an exploit designed take control of Oracle servers and use them to distribute more ransomware.

The attacker used various threats to coerce victims into paying ransom demands. Victims were told they would never get their data back if they did not pay up. The attacker demanded payment within 48 hours, or the data would be deleted, and in some cases told victims that the ransom demand would increase the longer they spent thinking about it.

The attacker used Mamba (HDDCryptor) ransomware, which encrypts entire hard drives. And after the hard drives are encrypted, the attacker’s victims were presented with a message telling them to send an email to one of the aforementioned email addresses to get payment instructions. The attacker apparently used a third email address, but this one did not use the same secret question, and the researcher could not obtain access to it.

The analysis also shows how profitable ransomware can be. The attacker using these email addresses collected $45,000 from a previous attack on a U.S. manufacturing firm. This money was collected through various attacks over the course of a few months. This information was obtained from the two compromised email accounts. These attacks appear to have been committed by a single individual, but it is possible that multiple individuals were involved.

This case demonstrates the ease with which ransomware attacks can be carried out, as well as their massive earning potential.  It’s important for individuals and companies to protect themselves primarily by ensuring that all important data and systems are backed up and that those backups are stored in a location segmented from production systems.

A wide variety of technical controls can help detect ransomware and prevent its spread. User awareness training can help reduce the effectiveness of ransomware distribution through phishing. However, none of these methods are 100% effective. That is why backups are essential to any defense strategy. Take a lesson from this analysis and protect yourself because this threat is far from over.

For more news and information on the battle against ransomware, visit the FightRansomware.com homepage today.

The Economics of Extortion: Understanding the ransomware market

We all know money is the motivating force behind cybercrimes like the creation and distribution of ransomware. The interesting twist with ransomware is that the basic rules of supply and demand become a little hard to follow. Typically you have a buyer and a seller. In the case of ransomware, the distributor—or supplier—has to steal what’s in demand—your data.

Cybercriminals create the demand by restricting access. Victims realize they need access and­—if they cannot get access themselves by restoring critical files from backup—they end up paying the ransom and fueling this economy. This applies to online consumers, small business owners, and CEOs—they have all paid to retrieve data.

It’s interesting to consider the ransomware economy in the following five segments:

1) Investment 

Cybercriminals leasing ransomware can obtain it for as little as $39 and as high as $3,000 depending on which type is purchased. They must then distribute it. Distribution costs include time spent creating and sending emails. According to Trustwave, an IT security team that spent time trying to dissect the ransomware economy, it would cost about $2,500 to spread 2,000 ransomware infections once you factor in the time to send emails and compromise sites.

2) Pricing 

Ransom demands in the United States have been known to be several hundred dollars higher than the same ransomware in Mexico or other countries with lower median incomes than the U.S. Ransomware authors have researched regions and incomes—and they understand that they can only charge what the market will bear. Ransomware authors also consider the bitcoin exchange rate when determining the ransom demand. This helps cyber criminals set a ransom that victims can afford to pay regardless of which country they’re from. In the U.S., the average ask is between $300 and $500, according to many industry sources.

3) Target market 

The target market for ransomware consists of consumers and companies that retain important or business-critical information and have the ability to pay the ransom. Unfortunately, these people also typically aren’t adhering to IT security best practices. Hospitals and other healthcare organizations are a popular target for cybercriminals because of the pressure to pay up quickly, rather than risk patient health.

4) Revenue 

Estimates as to how much has been paid in ransom tend to be conservative because many payments are undisclosed. That said, The U.S. Departments of Justice Internet Crime Complaint Center received reports of ransom payments totaling $24 million in 2015. And in July 2016, ransom payments for Cerber ransomware alone totaled $195,000 for the month. But the market is growing exponentially, and the FBI has said ransomware costs could total $1billion this year.

5) Competition 

The relatively low barrier to entry has resulted in fierce competition among cyber criminals. Some ransomware authors and cyber-extortionists have even adopted higher levels of professionalism to make it easier for victims to pay up. And, in an interesting angle to the supplier side, ransomware kits are easily available and come with simple instructions, meaning that distributors can sell ransomware to new, smaller distributors—as long as they are guaranteed a piece of the profits.

The ransomware economy is booming and returns are high. That means you can expect the number of ransomware attacks to continue rising. Protect yourself by having adequate backups in place before a ransomware attack occurs. Test your backups to ensure that the right data is being protected and can be restored in satisfactory time frames. Also, ensure that a backup copy is kept in a different location from production data so that ransomware does not infect both at the same time.

For more news and information on the battle against ransomware, visit the FightRansomware.com homepage today.