Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

Post by mrkramer » Mon, Jun 30, 2025, 11:22 AM UTC

skeezyboy wrote: post #178

mrkramer wrote: post #176

Earlier quoted context omitted.

Is there a way to check which one is currently in use? There must be. So Russians are slacking on this one? Also they could check in which language are files and folders named or they could check timezone or something. Years ago I loved to read malware RE articles and I remember they also checked for Belarussian, Ukrainian and most of the ex-USSR countries' languages. Isn't the most efficient way to check external IP…

geolocations of IPs change all the time, malware would need to speak to some server somewhere to get a current list. the russian keyboard method doesnt have the same risk of discovery

Post by chupasaurus » Mon, Jun 30, 2025, 12:52 PM UTC

throwaway48476 wrote: post #97

NoOn3 wrote: post #21

Earlier quoted context omitted.

I don't think this is done on purpose at the state level in Russia or China, It's just that sometimes government don't pay attention to those who do it if this is done in relation to somehow unfriendly countries. But the US also uses hacking for hostile purposes. For example, Stuxnet and some other cases. Yes, it's not ransomware, but the difference is not that huge. Western-backed countries like Ukraine are also doi…

When Russia arrests a hacker they're turned over to the GRU and told who to target. Western governments use hacking for intelligence gathering not economic warfare. The ochko123 fraudster was very connected with the Russian government, it's state policy. No, just using Linux doesn't make you safe.

Post by anonymars » Mon, Jun 30, 2025, 12:57 PM UTC

mr_mitm wrote: post #151

azov wrote: post #136

Earlier quoted context omitted.

The files I normally have write access to are my important files though. Immutable snapshots/offline backups help with those.

It's more important in a corporate setting. Lateral movement inside the network is much more likely if the attacker has local admin.

Post by hn-shithole » Mon, Jun 30, 2025, 1:24 PM UTC

ivan_gammel wrote: post #167

orbital-decay wrote: post #129

Earlier quoted context omitted.

Prompting a good LLM to convincingly act like a native isn't hard, neither is jailbreaking it if necessary. The hard thing in this case is verifying that it really does that.

Nah, it's not reproducible. It can certainly give you some common phrases, but to create an entire personality with its own set of speech patterns is a different thing. For example, Claude can suggest following friendly conversation starters to sound like a native (a quote below): Popular combinations for texts: "Прив! Чё как?" - "Hi! How's it going?" "Дарова, живой?" - "Hey, you alive?" "Салют! Как сам?" - "Hey! How…

Post by tackypenguin » Mon, Jun 30, 2025, 1:34 PM UTC

mrkramer wrote: post #179

wiz21c wrote: post #177

Earlier quoted context omitted.

any good read on how good they are nowadays ? (my background is cracking games 35 years ago :-))

I'm not a reverse engineer or a white hacker but I like reading about it. Most of the malware is made for Windows OS because of the Windows' enormous market share. Majority of information about Windows malware I get from big computer security companies' research blogs like: https://www.trendmicro.com/en_us/research.html https://www.proofpoint.com/us/blog https://research.checkpoint.com/ https://blog.talosintelligence…