I'd be surprised if there isn't malware that targets specifically systems with cyrillic keyboard enabled.
There are many Cyrillic keyboards.
Please don't attack Bulgarians :)
Many ransomware strains will abort if they detect a Russian keyboard installed (2021)
221–229 of 229 posts
Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)
#222Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)
#223As an aside, can anyone comment on how we can estimate the source of a cyber attack with any confidence? People and groups say "oh we know it's russians because of the methods used, they're known methods by russian groups". But if these methods are so clearly indicators of a certain group or certain national origin, then wouldn't it be effortless to then mimic those same methods to make it appear it's those groups when it's not?
It feels like if you had a battleship with a Russian flag and it fired on a US ship and ran way and wasn't caught, it'd be silly to be like "oh it's definitely the Russians 100%" because of the flag when it could have been a literal false flag. And there is a ton of political motivation to do false flags these days.
Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)
#224[flagged]
The Internet is by definition universal. Autonomous Systems make their own routing decisions. We cannot cut them off the Internet any more than we can cut off their sea access. If we were to do so (analogous to a naval blockade) you'd have succeeded in only cutting off civilians. Government sponsored or tolerated criminals would still ply their trade like in N Korea.
AS can also route and black hole traffic. There’s no real reason to continue allowing their traffic on the same internet when it’s all malicious
Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)
#225Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)
#226Earlier quoted context omitted.
Is there any downside to unironically doing this? Seems like it'd actually work.
There is an oracle license attached to it
IIRC the extensions pack has a (very limited) free license for personal and educational use, although I'm not sure if the 'pretending to be a sandbox' usecase would be covered.
Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)
#227Earlier quoted context omitted.
Also, if you identify as Russian or write Russian in the chats or mails to them, they will de-crypt your systems for free. I wonder how that works in this era of AI translation. Not quite the same but I remember there was a Russian shareware author who gave free licenses to Russians.
> I wonder how that works in this era of AI translation Simple translation isn’t enough to show cultural proximity. Patterns of speech are different. You can try to use AI to do the entire conversation, but e.g. Claude will refuse to give you exact phrases, since he is correctly assuming it is a social engineering attack.
Heh, Lobsters (2001) is looking more realistic by the day...
> "Nyet – no, sorry. Am apologize for we not use commercial translation software. Interpreters are ideologically suspect, mostly have capitalist semiotics and pay-per-use APIs. Must implement English more better, yes?"
> [...]
> "Are you saying you taught yourself the language just so you could talk to me?"
> "Da, was easy: Spawn billion-node neural network, and download Teletubbies and Sesame Street at maximum speed. Pardon excuse entropy overlay of bad grammar: Am afraid of digital fingerprints steganographically masked into my-our tutorials."
[...]
> "Am have been badly burned by viral end-user license agreements. Have no desire to experiment with patent shell companies held by Chechen infoterrorists. You are human, you must not worry cereal company repossess your small intestine because digest unlicensed food with it, right?"
https://www.antipope.org/charlie/blog-static/fiction/acceler...
Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)
#228Earlier quoted context omitted.
Why would local admin have relevance to network movement?
Because every time an account logs onto a computer, it leaves traces. Some ephemeral in memory, some permanent on disk. It can be Kerberos tickets, process tokens, domain cached credentials, hashes or even clear text passwords in memory. It's common practice in a lot of organizations for administrators to log on to random workstations to perform whatever task they need to do. Or there is a service running in the cont…
Even if you do everything perfectly there's always a chance one of Microsoft engineers made a mistake somewhere and somebody found it and is now sitting on a zero day. And now with vibe coding the likelihood of that went up by who knows how much. Even air gapped systems get infected if the attacker is sophisticated enough.
Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)
#229Earlier quoted context omitted.
It's more important in a corporate setting. Lateral movement inside the network is much more likely if the attacker has local admin.
Why would local admin have relevance to network movement?
As with the other reasons stated...
local admin, atleast in the environments I've seen, can still install software.
Installing and running something like AngryIPScanner may be possible as local admin