Reply to thread

Message: <blockquote data-quote="Brianwill" data-source="post: 876" data-attributes="member: 15">UNK: Free projects for developing anonymization tools.DS: How has your interaction with victim organizations changed since the beginning of the pandemic?UNK: A lot has changed. There is a crisis, they can't pay the amounts that were there before. Except for pharmaceutical companies. I think they should be given more attention. They're doing fine. We need to help them.DS: Do your operators target organizations that have cyber insurance?UNK: Yes, this is one of the most delicious dishes. Especially if you first hack insurers – get their customer base and work purposefully. And after we go through the list, you can take on the insurer itself.DS: How do you feel about the ransomware negotiators? Is it easier to deal with professionals? Do they help or complicate the task?UNK: 70% is only needed to bring down the price. Very often, they complicate the task. Well, for example, the company has revenue of $ 1 billion. They are being extorted $ 1 million. The negotiator comes and says: we don't care, we won't give you more than $ 15,000. We are reducing the price to $ 900,000. He's offering $ 20,000. Well, then we understand that a conversation with him is meaningless, and we start publishing data so that the network owners will give him a blow on the head for such negotiations. And, of course, after such tricks, the price only increases. Instead of 1 million dollars, they will pay one and a half. No one likes hucksters, especially with show-offs. So more often than not, they cause more harm. They only help when buying BTC or Monero. Everything else is harmful.DS: Do you recommend any specific negotiators to compromised companies, or do they look for them on their own? Not everyone has 100 BTC to buy back data, and it's not so easy to get them in a short time.UNK: We write to decent intermediaries so that they know the goal and can establish a dialogue. We give good discounts to good intermediaries so that they get a small profit, and companies pay less. As for deadlines — we can always allocate additional time. In general, if there is an understanding that you need to pay, but not so much, we will find a common language. But if we get delusional messages like "There's no money" or "We'll pay one-tenth," you have no one to blame but yourself.<img src="https://habrastorage.org/r/w1560/getpro/habr/post_images/e23/ceb/fce/e23cebfce06f7ff5da51511b07bf09b8.png" alt="e23cebfce06f7ff5da51511b07bf09b8.png" class="fr-fic fr-dii fr-draggable " style="" />Links to the REvil attacks are collected from private and clandestine sources. Courtesy of Recorded Future.DS: You said that you want to apply additional pressure through DDoS. How effective is this scheme?UNK: We don't use it often, unlike calls. Calling gives a very good result. We call each target, as well as their partners and journalists – the pressure increases significantly. And after that, if you start posting files, well, that's just great. But to end DDoS is to kill the company. Literally. I think we'll go after CEOs and / or founders of companies. Personal OSINT, bullying. I think this will also be a very interesting option. But victims should understand that the more resources we spend before paying the ransom – the more they will have to pay.DS: Tell me a secret.UNK: When I was a kid, I used to go through garbage cans and smoke cigarette butts. I walked 10 km one way to school. I wore the same clothes for six months. In my youth, I didn't eat in a communal apartment for two or three days. I'm a millionaire now.</blockquote>

Name

Verification