Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

7/18/2016
03:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Ransomware Victims Rarely Pay The Full Ransom Price

The purveyors of cyber-extortion schemes often willing to negotiate their ransom fees, F-Secure study finds.

Victims of ransomware scams almost never need to pay full sticker price to get their encrypted data back.

Those willing to negotiate can often get their ransom amount reduced substantially and obtain useful deadline extensions for paying it, a new report from F-Secure shows.

The security vendor recently conducted an experiment to evaluate what it described as the "customer experience" associated with five crypto-ransomware samples currently in the wild. The families evaluated for the experiment were Cerber, Jigsaw, Cryptomix, Shade, and TorrentLocker.

For the experiment, researchers at F-Secure created a victim persona named Christine Walters and used a fake Hotmail account in her name to communicate with the ransomware operators via their support channels. In order to appear convincing, Walters’ persona was made to appear as though she knew very little about ransomware, security, and Bitcoin, the preferred online currency for making ransom payments.  

The exercise showed that when victims dig in their heels a bit, criminals are likely to relent and try to make what they can rather than risk losing everything, says Sean Sullivan, security advisor at F-Secure.

“If you find yourself compromised, haggle,” Sullivan says. “Ask questions. Interact with the ransomware agent and get a feel for their responsiveness. The majority want to get something rather than nothing, and will cut a deal to close the case.”

The criminals behind three of the five ransomware families in F-Secure’s experiment were willing to negotiate on the ransom amount when asked. On average, they dropped the ransom amount by 29%. The TorrentLocker operators did not respond at all to "Walters’" emails, while those behind Cerber flatly refused to negotiate. In each case, the agents with whom Walters communicated were similarly willing to extend their payment deadlines--sometimes by days--when asked.

The operators of Cryptomix had the highest initial ransom amount at around $2,000. But when F-Secure’s reviewer protested the sticker price, the Cryptomix agent who responded to her email first dropped the demand by $1,000. Over the course of the next two days, the agent agreed to drop the demand by another $350, before holding firm at $650.

Similarly, the agent responding to emails pertaining to the Shade ransomware sample was willing to drop the ransom amount from $400 to $280 when F-Secure’s reviewer protested the original amount.

Among the ransomware families in the F-Secure study, the one with the best customer support was Jigsaw. The initial ransom amount at $150 was substantially lower than the ransoms demanded by the other ransomware families. The support agent for the malware agreed to reduce the amount to $125 when requested, and then offered help in finding a Bitcoin vendor. The Jigsaw support agent even helped F-Secure’s reviewer find stores in her local area that accepted payments for Bitcoins using Paysafecards, and also offered to stay online while payment was made.

“The perceived friendliness of some of the interactions was sincerely confusing to our reviewer,” Sullivan says. “Had they not been coached by me, I suspect they might be successfully socially engineered in other circumstances.”

English was the preferred language of communication for all of the malware families that F-Secure reviewed and all the chat interactions demanded knowledge of English.

Since 2005, the FBI’s Internet Crime Complaint Center (IC3) has received more than 7,700 complaints involving ransomware according to data released earlier this year. The incidents have resulted in victims paying more than $57 million in ransom money to cyber extortionists. The ransom fees have ranged in amounts from $200 to $10,000.

In addition, over the last one year, the US Department of Homeland Security has received over 320 incident reports of ransomware related activity on 29 federal agency networks. So far, though, no federal agency has had to pay a ransom in order to get ransomware removed from their computers, DHS says.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
7/20/2016 | 7:25:02 AM
Positive
That's good to know and shows that Ransomware doesn't necessarily need to be quite as scary as it often seems. Considering the hackers are getting something for nothing though, it makes sense that they would work with those affected - especially since an unfamiliarity with Bitcoin is likely to be common place in the people who are caught out by phishing and other scams that lead to ransomware infections.
A41202813GMAIL
50%
50%
A41202813GMAIL,
User Rank: Apprentice
7/21/2016 | 1:12:20 AM
Re: Positive
What Is The Difference Between RansomWare And A System Hard Drive Completely Unrecoverable ? - Absolutely None.

 

Some Basic Users Can Be Caught With Their Pants Down, But, For Companies, The Absence Of Multiple Backups Is Unforgivable - Any IT Manager Incapable Of Solving This Problem Single Handedly Should Be Fired On The Spot.

 
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
US Sets $5 Million Bounty For Russian Hacker Behind Zeus Banking Thefts
Jai Vijayan, Contributing Writer,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19604
PUBLISHED: 2019-12-11
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
CVE-2019-14861
PUBLISHED: 2019-12-10
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permiss...
CVE-2019-14870
PUBLISHED: 2019-12-10
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authent...
CVE-2019-14889
PUBLISHED: 2019-12-10
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence...
CVE-2019-1484
PUBLISHED: 2019-12-10
A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'.