Live data from Hacker News

Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

krebsonsecurity.com

141–150 of 229 posts

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#141
post #57

Earlier quoted context omitted.

You can game on Linux for many years now. Windows is mostly mandatory if you play multiplayer games with anticheat

yea pong working on linux doesen’t equal to gaming working on linux. Most games won’t start or play worse.

You have been living under a rock. Wine and proton are significantly faster than native windows. With valve's partnership with Archlinux last year, it's going to get even better

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#142

Earlier quoted context omitted.

You don't need Windows for games since ages. Steam games run on Linux.

Not really if you ever tried. Barely playing music, games obviously don’t work if you ever tried playing games. (hint, game x not beeing terrible doesen’t mean ”it works”). like I said at the start this is fairly obvious.

I play AAA games on steam deck running stock steam OS. It's rock solid. Look at the sales of steam deck alone, it's quite successful

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#143
post #17

Earlier quoted context omitted.

Every couple of years I give daily driving Linux a try. I still find that old joke about "Linux is only free if your time is worth nothing" to be quite apt.

I switched to Ubuntu "skinned" with Omakub a few months ago. Never looked back. Work with Windows on my work machine and use my *nix box as my daily dev driver and machine for surfing the net, doing emails and documents. I actually use it for nearly everything except vector graphics/dtp & images, as I am still too used to the affinity suite. Will try out Omarchy just for the fun of it - not that I expect it to become…

Please don't use that horrible script. It makes no sense to install such bloatware on top of an already bloated distro, which adds unnecessary attack surface. I would recommend fedora or arch, both are perfect for beginners with minimal bloat

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#144

Earlier quoted context omitted.

Confused by that as well - what version of chrome can be installed without admin?

It cannot. There are malicious third parties who have made distributions of Chromium that are fully functional browsers, installing in the user's AppData folder w/o Administrator rights, that have additional "functionality" like exfiltrating browsing history or displaying extra t This is really what any Electron-based app is. It's just Chromium running out of the AppData folder. There's a whole ecosystem of "shadow I…

I'm not doubting that there are malicious third parties distributing them, but Google themselves delivers Chromium that way:

https://download-chromium.appspot.com/

It's linked from the main chromium site:

https://www.chromium.org/getting-involved/download-chromium/

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#145
post #4

If you make your machine look like a malware execution sandbox, a lot of malware will terminate to avoid being analyzed. This is just part of the cat and mouse game.

Most windows servers are virtualised these days so I'm not sure this would work anymore. It might look at other indicators though

There's other tells, like this other top HN post right now tries to work around: https://wbenny.github.io/2025/06/29/i-made-my-vm-think-it-ha...

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#146
post #57

Earlier quoted context omitted.

You can game on Linux for many years now. Windows is mostly mandatory if you play multiplayer games with anticheat

yea pong working on linux doesen’t equal to gaming working on linux. Most games won’t start or play worse.

You’re either trolling or simply unaware but Steam and Proton allows you to run quite a bit of the Steam library on Linux with good performance.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#147

Earlier quoted context omitted.

As someone working in infosec for a largish 2000 seat organisation - it's honestly not inaccurate. No matter how much accessible information security training we try to provide and the EDR controls we implement, >95% of our incidents involve an end-user following (sometimes extremely obvious) phishing links. And contrary to what you've said, Windows Defender (in conjunction with Airlock) has actually saved us from ra…

Where I work has recently implemented Airlock and my laptop feels a lot less responsive since. I'm aware of the whole security trade-off, just wondering how noticeable it has been in your organisation, if at all? Having said that, two things worth considering in my case: 1. My laptop is relatively old and, I think, overdue for replacement (8GB RAM, really?) 2. Windows Defender + Airlock + CrowdStrike + Netskope + Nes…

Not sure the exact combination of internal security nonsense used, but my corporate laptop idles at a good 20% cpu utilization. It would not surprise me at all to know that the products are stepping over themselves and scanning each other. Double plus ungood is that any programming tool I use seemingly gets extra scrutiny and can take 10x as long as I know it would on a non-compromised Linux machine.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#148

Earlier quoted context omitted.

It cannot. There are malicious third parties who have made distributions of Chromium that are fully functional browsers, installing in the user's AppData folder w/o Administrator rights, that have additional "functionality" like exfiltrating browsing history or displaying extra t This is really what any Electron-based app is. It's just Chromium running out of the AppData folder. There's a whole ecosystem of "shadow I…

I'm not doubting that there are malicious third parties distributing them, but Google themselves delivers Chromium that way: https://download-chromium.appspot.com/ It's linked from the main chromium site: https://www.chromium.org/getting-involved/download-chromium/

I thought that was a pretty common pattern now for a variety of software tools. Was pretty sure that Chrome + Firefox did not need administrator privileges to be available to a user.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#149
post #2

I wonder if this is still actually the case after Brian Krebs announced it to the world in 2021.

Yes, absolutely. This is mostly a legal/enforcement decision. If you avoid Russian authorities, they avoid you. Also Russia is nowhere near as fertile ground as the US. There are plenty of low paid entry level office workers in the US who will gladly update their AP payment information for business email compromise (BEC). $2.77 billion lost to BEC in 2024, the most lucrative category. Total losses in the US were $16 billion from 859,532 complaints.

One investigation I worked a threat actor in China socially engineered their way into getting an employee account in a US company created for them. They were so persuasive they also got their account inserted into the approval process as a manager for creating other new employee accounts (at a specific location) in the identity workflow. They did this only for the purpose of siphoning discounts that are available to employees, and they resold those which resulted in about one million dollars loss over a period of a couple of years.

https://www.fbi.gov/contact-us/field-offices/elpaso/news/fbi...

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#150
post #149
post #2

I wonder if this is still actually the case after Brian Krebs announced it to the world in 2021.

Yes, absolutely. This is mostly a legal/enforcement decision. If you avoid Russian authorities, they avoid you. Also Russia is nowhere near as fertile ground as the US. There are plenty of low paid entry level office workers in the US who will gladly update their AP payment information for business email compromise (BEC). $2.77 billion lost to BEC in 2024, the most lucrative category. Total losses in the US were $16…

That's interesting, but it doesn't exactly answer my question about switching my keyboard to Russian.
Post reply on HN