<story><title>DarkSide ransomware gang quits after servers, Bitcoin stash seized</title><url>https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/</url></story><parent_chain><item><author>g_p</author><text>&amp;gt; The REvil representative said its program was introducing new restrictions on the kinds of organizations that affiliates could hold for ransom, and that henceforth it would be forbidden to attack those in the “social sector” (defined as healthcare and educational institutions) and organizations in the “gov-sector” (state) of any country. Affiliates also will be required to get approval before infecting victims.&lt;p&gt;Statements like this seem to point to ransomware activities being far more coordinated and &amp;quot;business-like&amp;quot; than they often get credit for.&lt;p&gt;I do wonder if ransomware is (in a strange way) a(n illegal) free-market response to what is perceived to be an under-valuation of tech skills - aggrieved people who can carry out attacks and gain access to deploy ransomware are likely to be able to earn more through this route, even factoring in their &amp;quot;risk of being caught&amp;quot;.&lt;p&gt;If a market correction occurs (ransomware becomes a real fear, organisations rapidly start to value security skills more and pay &amp;quot;megabucks&amp;quot; for the skills and hire them at-scale), the risk&amp;#x2F;reward of being caught starts to mean access brokers reduce in number, and the compensation reaches a free market equilibrium (accounting for the &amp;quot;getting caught&amp;quot; risk of criminal activity).&lt;p&gt;A lot of the time I still see people trying to hire entry-level people into live&amp;#x2F; operational security roles, without the experience they&amp;#x27;d need. I wonder if this is partly due to a desire to cut costs, rather than accept the need to pay rock-star compensation?</text></item></parent_chain><comment><author>WrtCdEvrydy</author><text>&amp;gt; seem to point to ransomware activities being far more coordinated and &amp;quot;business-like&amp;quot; than they often get credit for.&lt;p&gt;This is a business that actually provides better support than a regular business.&lt;p&gt;From conversations with friends in the Infragard side of this, and the agencies that collaborate, they have 24&amp;#x2F;7 English support available before and after payment, as well as decryption remote support if you can&amp;#x27;t get your files decrypted... there are also instances of refunds if they can&amp;#x27;t decrypt your files due to technical issues.&lt;p&gt;Unlike regular businesses, support is a sales channel since it&amp;#x27;s the way to ensure you get paid so a lot of resources go to support activities in these &amp;quot;organizations&amp;quot;.</text></comment>
<story><title>DarkSide ransomware gang quits after servers, Bitcoin stash seized</title><url>https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/</url></story><parent_chain><item><author>g_p</author><text>&amp;gt; The REvil representative said its program was introducing new restrictions on the kinds of organizations that affiliates could hold for ransom, and that henceforth it would be forbidden to attack those in the “social sector” (defined as healthcare and educational institutions) and organizations in the “gov-sector” (state) of any country. Affiliates also will be required to get approval before infecting victims.&lt;p&gt;Statements like this seem to point to ransomware activities being far more coordinated and &amp;quot;business-like&amp;quot; than they often get credit for.&lt;p&gt;I do wonder if ransomware is (in a strange way) a(n illegal) free-market response to what is perceived to be an under-valuation of tech skills - aggrieved people who can carry out attacks and gain access to deploy ransomware are likely to be able to earn more through this route, even factoring in their &amp;quot;risk of being caught&amp;quot;.&lt;p&gt;If a market correction occurs (ransomware becomes a real fear, organisations rapidly start to value security skills more and pay &amp;quot;megabucks&amp;quot; for the skills and hire them at-scale), the risk&amp;#x2F;reward of being caught starts to mean access brokers reduce in number, and the compensation reaches a free market equilibrium (accounting for the &amp;quot;getting caught&amp;quot; risk of criminal activity).&lt;p&gt;A lot of the time I still see people trying to hire entry-level people into live&amp;#x2F; operational security roles, without the experience they&amp;#x27;d need. I wonder if this is partly due to a desire to cut costs, rather than accept the need to pay rock-star compensation?</text></item></parent_chain><comment><author>yebyen</author><text>When I heard that this pipeline company started advertising a job opening for CyberSecurity Advisor in the last few days, and heard today the ransom of about $5 million was paid, my first reaction was to say &amp;quot;I bet the salary for that position is a lot less than $5 million, and I bet the budget for that department will be less, too...&amp;quot;</text></comment>