Attacks/Breaches

7/18/2016
03:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Ransomware Victims Rarely Pay The Full Ransom Price

The purveyors of cyber-extortion schemes often willing to negotiate their ransom fees, F-Secure study finds.

Victims of ransomware scams almost never need to pay full sticker price to get their encrypted data back.

Those willing to negotiate can often get their ransom amount reduced substantially and obtain useful deadline extensions for paying it, a new report from F-Secure shows.

The security vendor recently conducted an experiment to evaluate what it described as the "customer experience" associated with five crypto-ransomware samples currently in the wild. The families evaluated for the experiment were Cerber, Jigsaw, Cryptomix, Shade, and TorrentLocker.

For the experiment, researchers at F-Secure created a victim persona named Christine Walters and used a fake Hotmail account in her name to communicate with the ransomware operators via their support channels. In order to appear convincing, Walters’ persona was made to appear as though she knew very little about ransomware, security, and Bitcoin, the preferred online currency for making ransom payments.  

The exercise showed that when victims dig in their heels a bit, criminals are likely to relent and try to make what they can rather than risk losing everything, says Sean Sullivan, security advisor at F-Secure.

“If you find yourself compromised, haggle,” Sullivan says. “Ask questions. Interact with the ransomware agent and get a feel for their responsiveness. The majority want to get something rather than nothing, and will cut a deal to close the case.”

The criminals behind three of the five ransomware families in F-Secure’s experiment were willing to negotiate on the ransom amount when asked. On average, they dropped the ransom amount by 29%. The TorrentLocker operators did not respond at all to "Walters’" emails, while those behind Cerber flatly refused to negotiate. In each case, the agents with whom Walters communicated were similarly willing to extend their payment deadlines--sometimes by days--when asked.

The operators of Cryptomix had the highest initial ransom amount at around $2,000. But when F-Secure’s reviewer protested the sticker price, the Cryptomix agent who responded to her email first dropped the demand by $1,000. Over the course of the next two days, the agent agreed to drop the demand by another $350, before holding firm at $650.

Similarly, the agent responding to emails pertaining to the Shade ransomware sample was willing to drop the ransom amount from $400 to $280 when F-Secure’s reviewer protested the original amount.

Among the ransomware families in the F-Secure study, the one with the best customer support was Jigsaw. The initial ransom amount at $150 was substantially lower than the ransoms demanded by the other ransomware families. The support agent for the malware agreed to reduce the amount to $125 when requested, and then offered help in finding a Bitcoin vendor. The Jigsaw support agent even helped F-Secure’s reviewer find stores in her local area that accepted payments for Bitcoins using Paysafecards, and also offered to stay online while payment was made.

“The perceived friendliness of some of the interactions was sincerely confusing to our reviewer,” Sullivan says. “Had they not been coached by me, I suspect they might be successfully socially engineered in other circumstances.”

English was the preferred language of communication for all of the malware families that F-Secure reviewed and all the chat interactions demanded knowledge of English.

Since 2005, the FBI’s Internet Crime Complaint Center (IC3) has received more than 7,700 complaints involving ransomware according to data released earlier this year. The incidents have resulted in victims paying more than $57 million in ransom money to cyber extortionists. The ransom fees have ranged in amounts from $200 to $10,000.

In addition, over the last one year, the US Department of Homeland Security has received over 320 incident reports of ransomware related activity on 29 federal agency networks. So far, though, no federal agency has had to pay a ransom in order to get ransomware removed from their computers, DHS says.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
A41202813GMAIL
50%
50%
A41202813GMAIL,
User Rank: Apprentice
7/21/2016 | 1:12:20 AM
Re: Positive
What Is The Difference Between RansomWare And A System Hard Drive Completely Unrecoverable ? - Absolutely None.

 

Some Basic Users Can Be Caught With Their Pants Down, But, For Companies, The Absence Of Multiple Backups Is Unforgivable - Any IT Manager Incapable Of Solving This Problem Single Handedly Should Be Fired On The Spot.

 
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
7/20/2016 | 7:25:02 AM
Positive
That's good to know and shows that Ransomware doesn't necessarily need to be quite as scary as it often seems. Considering the hackers are getting something for nothing though, it makes sense that they would work with those affected - especially since an unfamiliarity with Bitcoin is likely to be common place in the people who are caught out by phishing and other scams that lead to ransomware infections.
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18913
PUBLISHED: 2019-03-21
Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attacker to take full control of the system from any location with...
CVE-2018-20031
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to preemptive item deletion in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2018-20032
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor daemon t...
CVE-2018-20034
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to adding an item to a list in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2019-3855
PUBLISHED: 2019-03-21
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.