Criminals don’t need PR, especially when it comes to ransomware

I’ve been contemplating this article for some time now, and I’ve read this article we’re going to talk about a little bit ago. It seems as though if you’re in the criminal world, you’ve got it easy. “As long as I don’t get caught,” you think or say, “I’ve got it made.” Ransomware is the most lucritive business out there. Have a package, make it undetectable by software like defender, and you’ve got it made. All you have to do is the hard work in making sure you get the maximum payment you can.

That isn’t hard, you do the research before you tell the software to encrypt the data, and you’re good. Yes, there have been cyberactors that have been caught, but the PR is quite easy.

When you think of getting hired, you find a job that you know you’re capable of. Trick is, the PR work you need to work on is your PR. You’ve got a good online presence, you go in and answer the questions to the best of your ability. You don’t get hired. If you send ransomware, you’ve got it made, because actors have developed it and sold it to you.

Currently, more than a dozen ransomware crime gangs have erected their own blogs to publish sensitive data from victims. A few of these blogs routinely
issue self-serving press releases, some of which gallingly refer to victims as “clients” and cast themselves in a beneficent light. Usually, the blog posts
that appear on ransom sites are little more than a teaser — screenshots of claimed access to computers, or a handful of documents that expose proprietary
or financial information.

The goal behind the publication of these teasers is clear, and the ransomware gangs make no bones about it: To publicly pressure the victim company into
paying up. Those that refuse to be extorted are told to expect that huge amounts of sensitive company data will be published online or sold on the dark
web (or both).

Emboldened by their successes, several ransomware gangs recently have started demanding two ransoms: One payment to secure a digital key that can unlock
files, folders and directories encrypted by their malware, and a second to avoid having any stolen information published or shared with others.

Not only are these guys putting up blogs like you and I would, but they publish some of this data to entice you to pay. Now, they’re going to ask for a second payment not to publish the stash? I don’t know how much harder we need to work on getting us jobs, but if I were publishing stolen information on a blog, I’d be as sure as caught than I would landing a job. I don’t remember the article talking about whether these blogs are on the underground or dark web or not. This has aught to be the worst thing I’ve ever seen in this field.

Want to read more from Krebs on Security? Ransomware Gangs Don’t Need PR Help is the article and good luck on your job hunt. May the best PR win!