Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DarkSide ransomware gang quits after servers, Bitcoin stash seized

krebsonsecurity.com

Post reply on HN
Print view View original

201–210 of 623 posts

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#201

Post by jabroni_salad »

WrtCdEvrydy wrote: post #104
g_p wrote: post #43

> The REvil representative said its program was introducing new restrictions on the kinds of organizations that affiliates could hold for ransom, and that henceforth it would be forbidden to attack those in the “social sector” (defined as healthcare and educational institutions) and organizations in the “gov-sector” (state) of any country. Affiliates also will be required to get approval before infecting victims. Sta…

> seem to point to ransomware activities being far more coordinated and "business-like" than they often get credit for. This is a business that actually provides better support than a regular business. From conversations with friends in the Infragard side of this, and the agencies that collaborate, they have 24/7 English support available before and after payment, as well as decryption remote support if you can't get…

Maybe with Darkside, but they account for a very small amount of activity. Back in the Gandcrab days, anyone with a credit card could fire up their own tenancy, and they mostly sucked at it. They would lose the decryption keys or send non functional decryptors. They were not interested in talking and just thought the RaaS platform would be a passive income for them.

I mostly dont do ransomware housecalls anymore, but my teammates tell me the situation has mostly not improved.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#202

Post by TrackerFF »

bredren wrote: post #45

It was a mistake to attack the business side of the oil company, because it created what could be sold as reasonable doubt to shut down the pipeline. As a result, the ransom had the optics of an attack on infrastructure. As evidenced by the coverage of Americans desperately filling up containers. This created the impetus for the US to treat this as an incident far and above the ambient ransomware activities leading u…

I got downvoted for saying that maybe it's time to treat serious ransomware attacks (infrastructure, security, health, etc.) as terrorism - as in the sense that they're a threat to the national security. But this kinda shows the response I was referencing to.

A lot of people like to think of ransomware attacks as the ultimate stress test as far as security goes, and thus a good thing - but let's not get too blinded by our professions (most probably in tech), these kinds of attacks can have serious consequences: Imagine if some foreign state agency (masquerading as hackers) launches a multiheaded attack on, say, utilities plants - in the middle of the winter. The victims/targets will pay whatever us necessary.

With that said, I understand that many people will recoil at such things - we saw what the patriot act did, and how easy it is to overstep and abuse such laws, in the name of "national security". But it is a serious problem, in the same way actual piracy thrived in the gulf of Aden, as soon as the shipping companies started paying.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#203

Post by normac2 »

bredren wrote: post #45

It was a mistake to attack the business side of the oil company, because it created what could be sold as reasonable doubt to shut down the pipeline. As a result, the ransom had the optics of an attack on infrastructure. As evidenced by the coverage of Americans desperately filling up containers. This created the impetus for the US to treat this as an incident far and above the ambient ransomware activities leading u…

> This created the impetus for the US to treat this as an incident far and above the ambient ransomware activities leading up to this.

And why would you say this is desirable to the US? Just general "governments take advantage of crises to gain power" reasons?

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#204

Post by rini17 »

bredren wrote: post #45

It was a mistake to attack the business side of the oil company, because it created what could be sold as reasonable doubt to shut down the pipeline. As a result, the ransom had the optics of an attack on infrastructure. As evidenced by the coverage of Americans desperately filling up containers. This created the impetus for the US to treat this as an incident far and above the ambient ransomware activities leading u…

It was a mistake to attack overtly. I believe $5 million can be easily drained covertly and inconspicuously from megacorporations.

I'm pretty sure it's actually happening we just don't hear about it.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#206

Post by sudosysgen »

adventured wrote: post #164
mwvr wrote: post #85

Earlier quoted context omitted.

doesn't work if the fiat converted to is in another jurisdiction

There are few jurisdictions where the US Government can't easily get at you, either physically or financially. China, Venezuela, North Korea, Russia the list is super thin and almost exclusively places you either don't want to be or where you better be a protected local (otherwise they'll just hang you out to dry for their own benefit or amusement). Most authorities around the world will want to nail you - and or you…

Don't forget Iran and Vietnam.

You don't need to live there for very long. Just for long enough to cash out into fiat, launder the money, etc...

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#207

Post by TameAntelope »

KONAir wrote: post #190

I still can't wrap my head around how can such a critical infrastructre is not air gapped. This is just so... basic. You will never be secure enough, this is not what internet is for.

It probably is, their billing systems aren’t though.

I believe they shut down the pipeline because they were unable to bill.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#208

Post by skeeter2020 »

jkubicek wrote: post #91
Denvercoder9 wrote: post #81

Earlier quoted context omitted.

Oil does require infrastructure. What you put in your car is several steps removed from what is pumped out of the ground.

I think the parent's point was that if oil infrastructure is completely disrupted, consumers won't even be affected for a few days and the short-term consequences will be somewhat minor (some percentage of drivers won't be able to drive, deliveries may be delayed). If a hospital is shut down, then people will start dying immediately. The consequences are much more direct and severe.

hospitals without IT don't just kill all their patients and shut down. They slow down and loose capacity and capability while the realtively low-tech business of doctoring continues.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#210

Post by inputError »

KONAir wrote: post #190

I still can't wrap my head around how can such a critical infrastructre is not air gapped. This is just so... basic. You will never be secure enough, this is not what internet is for.

ive supported some major oil drilling companies in the midwest and they are the biggest cheapskates I have ever dealt with, and that's including credit unions.
Post reply on HN