Attacks/Breaches

7/18/2016
03:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Ransomware Victims Rarely Pay The Full Ransom Price

The purveyors of cyber-extortion schemes often willing to negotiate their ransom fees, F-Secure study finds.

Victims of ransomware scams almost never need to pay full sticker price to get their encrypted data back.

Those willing to negotiate can often get their ransom amount reduced substantially and obtain useful deadline extensions for paying it, a new report from F-Secure shows.

The security vendor recently conducted an experiment to evaluate what it described as the "customer experience" associated with five crypto-ransomware samples currently in the wild. The families evaluated for the experiment were Cerber, Jigsaw, Cryptomix, Shade, and TorrentLocker.

For the experiment, researchers at F-Secure created a victim persona named Christine Walters and used a fake Hotmail account in her name to communicate with the ransomware operators via their support channels. In order to appear convincing, Walters’ persona was made to appear as though she knew very little about ransomware, security, and Bitcoin, the preferred online currency for making ransom payments.  

The exercise showed that when victims dig in their heels a bit, criminals are likely to relent and try to make what they can rather than risk losing everything, says Sean Sullivan, security advisor at F-Secure.

“If you find yourself compromised, haggle,” Sullivan says. “Ask questions. Interact with the ransomware agent and get a feel for their responsiveness. The majority want to get something rather than nothing, and will cut a deal to close the case.”

The criminals behind three of the five ransomware families in F-Secure’s experiment were willing to negotiate on the ransom amount when asked. On average, they dropped the ransom amount by 29%. The TorrentLocker operators did not respond at all to "Walters’" emails, while those behind Cerber flatly refused to negotiate. In each case, the agents with whom Walters communicated were similarly willing to extend their payment deadlines--sometimes by days--when asked.

The operators of Cryptomix had the highest initial ransom amount at around $2,000. But when F-Secure’s reviewer protested the sticker price, the Cryptomix agent who responded to her email first dropped the demand by $1,000. Over the course of the next two days, the agent agreed to drop the demand by another $350, before holding firm at $650.

Similarly, the agent responding to emails pertaining to the Shade ransomware sample was willing to drop the ransom amount from $400 to $280 when F-Secure’s reviewer protested the original amount.

Among the ransomware families in the F-Secure study, the one with the best customer support was Jigsaw. The initial ransom amount at $150 was substantially lower than the ransoms demanded by the other ransomware families. The support agent for the malware agreed to reduce the amount to $125 when requested, and then offered help in finding a Bitcoin vendor. The Jigsaw support agent even helped F-Secure’s reviewer find stores in her local area that accepted payments for Bitcoins using Paysafecards, and also offered to stay online while payment was made.

“The perceived friendliness of some of the interactions was sincerely confusing to our reviewer,” Sullivan says. “Had they not been coached by me, I suspect they might be successfully socially engineered in other circumstances.”

English was the preferred language of communication for all of the malware families that F-Secure reviewed and all the chat interactions demanded knowledge of English.

Since 2005, the FBI’s Internet Crime Complaint Center (IC3) has received more than 7,700 complaints involving ransomware according to data released earlier this year. The incidents have resulted in victims paying more than $57 million in ransom money to cyber extortionists. The ransom fees have ranged in amounts from $200 to $10,000.

In addition, over the last one year, the US Department of Homeland Security has received over 320 incident reports of ransomware related activity on 29 federal agency networks. So far, though, no federal agency has had to pay a ransom in order to get ransomware removed from their computers, DHS says.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
A41202813GMAIL
50%
50%
A41202813GMAIL,
User Rank: Apprentice
7/21/2016 | 1:12:20 AM
Re: Positive
What Is The Difference Between RansomWare And A System Hard Drive Completely Unrecoverable ? - Absolutely None.

 

Some Basic Users Can Be Caught With Their Pants Down, But, For Companies, The Absence Of Multiple Backups Is Unforgivable - Any IT Manager Incapable Of Solving This Problem Single Handedly Should Be Fired On The Spot.

 
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
7/20/2016 | 7:25:02 AM
Positive
That's good to know and shows that Ransomware doesn't necessarily need to be quite as scary as it often seems. Considering the hackers are getting something for nothing though, it makes sense that they would work with those affected - especially since an unfamiliarity with Bitcoin is likely to be common place in the people who are caught out by phishing and other scams that lead to ransomware infections.
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.