> The REvil representative said its program was introducing new restrictions on the kinds of organizations that affiliates could hold for ransom, and that henceforth it would be forbidden to attack those in the “social sector” (defined as healthcare and educational institutions) and organizations in the “gov-sector” (state) of any country. Affiliates also will be required to get approval before infecting victims.
Statements like this seem to point to ransomware activities being far more coordinated and "business-like" than they often get credit for.
I do wonder if ransomware is (in a strange way) a(n illegal) free-market response to what is perceived to be an under-valuation of tech skills - aggrieved people who can carry out attacks and gain access to deploy ransomware are likely to be able to earn more through this route, even factoring in their "risk of being caught".
If a market correction occurs (ransomware becomes a real fear, organisations rapidly start to value security skills more and pay "megabucks" for the skills and hire them at-scale), the risk/reward of being caught starts to mean access brokers reduce in number, and the compensation reaches a free market equilibrium (accounting for the "getting caught" risk of criminal activity).
A lot of the time I still see people trying to hire entry-level people into live/ operational security roles, without the experience they'd need. I wonder if this is partly due to a desire to cut costs, rather than accept the need to pay rock-star compensation?