Interview with a ransomware group

https://therecord.media/an-interview-with-blackmatter-a-new-ransomware-group-thats-learning-from-the-mistakes-of-darkside-and-revil/

by stereoradonc • 5 years ago

120 129 5 years ago

therecord.media

4gotunameagain2• 5 years ago

I find myself puzzled by organizations like these. Let's say they do not attack infrastructure or other critical services, and only leech off huge companies.

I cannot argue against it?

jnorthrop• 5 years ago

Are you really intending to condone illegal activity? Just because their targeting "wealthy" companies? That is like condoning a mugger because he is working in a rich neighborhood and not targeting the impoverished.

everyone• 5 years ago

The rich people in that neighborhood have acquired their wealth in an unfair injust way.

typon• 5 years ago

If I heard news that Jeff Bezos bank account was hacked and $50 million dollars were stolen, I don't think I would even bat an eye. When I hear of ransomware shutting down hospital computers I'm furious and want to see these clowns rot in jail. There's clearly a spectrum here of where it starts becoming a heinous act.

trasz7• 5 years ago

Bit of an advocatus diaboli, but… Crimes are crimes because they hurt people. Here we’re talking about just lowering company’s profits; same thing happens naturally due to market forces and nobody complains.

4gotunameagain2• 5 years ago

I was looking for a solid argument, since I am not able to provide one. So far there are none presented here either.

Are we really going to justify this just by "it is against the law"? So many things are against the law, so many ancient laws demonstrate the inability of humans to create the absolute corpus of ethical behaviours™.

danpalmer6• 5 years ago

and only leech off huge companies. I cannot argue against it?

Médecins Sans Frontières is a huge company. Their annual budget is around $1.6bn. Are you ok with them being subject to ransomware attacks?

rory• 5 years ago

Allegedly BlackMatter is not.

It would not extort healthcare, critical infrastructure, oil and gas, defense, non-profit, and government organizations

boomlinde• 5 years ago

In this instance, they claim that they will not attack non-profits, which puts organizations like MSF out of harm's way.

anthony_r• 5 years ago

Let's inverse the question: please provide a list of companies that would be OK to target, according to you.

CleverLikeAnOx3• 5 years ago

If a robber steals one grain of rice from each person in a town, was anyone harmed? If you think not, then what if a thousand robbers do the same?

Leeching off of companies is kind of like stealing a grain of rice from everyone. The company's costs increase and the price eventually makes its way back to the consumer.

Another way to think about it is the total amount of labor needed for the world to operate as it does. In a world that has no ransomware, the labor needed is X. In a world with ransomware it is X + cost of building ransomware + cost of dealing with ransomware.

CharlesW• 5 years ago

Leeching off of companies is kind of like stealing a grain of rice from everyone.

I'm sure the criminals console themselves by thinking about it that way, but as someone who had to use an emergency room and was denied other services during the month+ Scripps was down (during a global pandemic, no less), it was easy to see how ransomware attacks can directly hurt an enormous number of employees and customers.

mcguire5• 5 years ago

As a general rule, theft is considered a bad thing. Why do you think it's acceptable?

danpalmer6• 5 years ago

I feel like giving criminals a platform like this is wrong.

I'm all for reformed criminals giving interviews in the context of what they did being wrong, but this is an interview about how they're getting better at their crimes.

Regardless of how easy it might be given security practices, these are crimes, and they are crimes for a reason: they cause damage. Their impact is felt beyond the ransom money paid, it's felt by employees who may be put in terrible positions as their work is held ransom and who might pay up personally to avoid problems at work, it's felt by customers of these companies who end up with higher prices, it's felt by countries as their output is hit. The fact that this "industry" is getting more "professional" does not change the fact that it's harmful. They don't deserve the publicity and attention that this sort of platforming provides them.

ailef6• 5 years ago

Considering the huge environmental damage created by e.g. oil companies (and many others), one could say the same about them?

The only difference is what these people do is illegal while what the companies do is not: the damage, though, is arguably on the same scale, if not lower for ransomware attacks depending on which infrastructure is attacked.

eklavya• 5 years ago

As much as I loathe our response towards global warming. This comment shows why equivalence should not be taken lightly and how absurd the result can be.

How about holding people for ransom that is equivalent for sure, how about killing people? Well oil industry eventually ends up killing some people.

Let’s put a stop to oil industry before we deal with the kidnappers and killers!!

cjblomqvist2• 5 years ago

Following that logic nurses delivering babies are also on the same level considering they're supporting the growth of the human race (which causes all the environmental damage)...

There's a huge difference depending on "details"

danpalmer6• 5 years ago

I personally take moral issue with oil companies, but society as a whole has not decided that they are deserving of punishment, so I save my actions for campaigning, lobbying, and supporting groups that are pushing for change.

On the other hand, society has decided, via law making, that ransomware attacks are deserving of punishment.

With so many differing opinions it's hard to please everyone. I'm in favour of having a range of voices that I might not agree with represented in media, but criminals advertising their crimes and talking about how they're getting better at doing it feels like it's fairly clearly past a line.

wil4212• 5 years ago

Whataboutism. Let’s respond by bringing up a completely unrelated topic to justify the actions of criminal organizations.

These are organized crime activities akin to cartel kidnappings, Somalia Pirates, mob extortion, and kidnapping tourists for ransom. 21st century pirates/mobsters.

How long until ransomware becomes extortion or protection schemes? Pay us a yearly fee and we’ll not hack you and if someone does hack you we’ll hack them back.

jongorer• 5 years ago

what makes you so sure ransomware is "wrong"?

let me rephrase this: do you think corporations are "good"?

andruby• 5 years ago

that is not the same question :)

some corporations provide value to society. some don't. the evaluation of this will depend on your personal values.

my personal values do evaluate ransomware as "wrong". and the laws of most (all?) countries evaluate ransomware as illegal and thus legally "wrong".

TchoBeer5• 5 years ago

Ransomware companies are also corporations

zionic• 5 years ago

It's hard to feel sorry for these companies when they have neglected security for so long.

This outcome was inevitable, and hitting the bean counters where it hurts (financial bottom line) is the only way to effect change.

danpalmer6• 5 years ago

I don't have metal bars across my windows, should they start targeting my house to force me to add them?

I'm being somewhat facetious, but I want to live in a society where not being hyper focused on all forms of security at all times, and just being _safe_ is an ok way to live your life.

"It's easy so we'll do it" is not a defence of this practice. The only reason the security is needed at all is because of people like this. I'm not saying security isn't important, but being bad at security is not a defence of people who take advantage of that poor security.

rpmisms• 5 years ago

I completely agree. People should be unaware of ransomware attacks, despite the increase in frequency, scope, and severity over the last decade.

Platforming criminals and making sure more people understand their competence and the threat model is a good thing. We should be scared.

danpalmer6• 5 years ago

There's a difference between educating and warning people about attacks, and having the attackers do that themselves. I'm not saying we shouldn't talk about these things, we absolutely should! It just shouldn't be by interviewing and glamorising those committing the crimes.

vmception• 5 years ago

I think making companies and the industry more aware that their bug bounties are undervalued is important. It raises the bug bounties and creates more opportunities.

This is an approach of like "okay lets just ignore your rational for not doing that and give the hackers a platform until you change"

SCHiM• 5 years ago

I think this is a good thing. It might show potential victims that their opponents are not a bunch of smelly teenagers hopping online after midnight.

These are multi-million (billion?) businesses. There's strategic leadership, target acquisition pipelines, R&D, talent recruitment and coordination with other businesses in the space.

There's every indication that with a little bit of protection money, you can even run your business with no interference from the law, as long as you don't mess around in your own backyard.

You can see from the blog post, that this "company" has done a product-market-fit analysis. They've taken a look at their competitors' work, considered the pros/cons, and decided that they can do better. Since they are a b2b company (hehe) you can be reasonably sure this is not some PR aimed at consumers. I think it reads as a recruitment pitch to their lead generators (read: hackers whom infect other networks for them).

You can see the pitch, it almost reads as a vacancy post:

- We make a lot of money

- We're new to the scene but already have had success

- We only work with the best hackers

- We pay you lots of money to infect a network, if you got what it takes

rmah• 5 years ago

When groups do this in furtherance of illegal activities, it's called "organized crime". And such groups need to be pursued aggressively because they are corrosive and poisonous to society at large. If they are not actively and aggressively fought, their negative effects seep into broader society and can become entrenched for generations.

PaulDavisThe1st• 5 years ago

as long as you don't mess around in your own backyard.

Based on the recent pipeline incident, it seems that these crime groups realize there are other places you'd better not mess around.

Screw with Bank A or Company B ... fine. Screw with infrastructure of a country with a large scale military, control over large chunks of global finance, and so much more ... probably not a good idea.

Bellamy• 5 years ago

Next step is to search for investors.

imglorp• 5 years ago

As for repercussions, notice they indicated "fear of the United States and its planning of offensive cyber operations". We don't hear a lot about US offensive operations. Maybe they're ongoing but they don't get a lot of press. If that's the case maybe the need more for deterrence purposes. Does anyone have any visibility?

Also, notice they did not mention any concern the FSB would invite them for tea, pay respects to their families, or any other ... imperial entanglements. This says a world about their standing in Russia, whether tolerated, encouraged or some other arrangement.

the-dude• 5 years ago

Stuxnet and Windows are pretty well known I would say.

wongarsu• 5 years ago

Russia's policy is to leave cybercrime alone as long as they don't attack Russia.

A hacker group in Russia declaring to only target companies in the USA and Great Britain is like a US group that only targets Iran and China. US agencies probably wouldn't find time in their busy schedules to go after someone targeting Iran either.

sudosysgen• 5 years ago

*Russia and it's allies, CIS states are also off-limits.

But yes, you are correct.

nradov4• 5 years ago

Hence why some malware programs won't activate if they detect the computer's keyboard layout is set to Russian.

mcguire5• 5 years ago

You might check out Inside Cyber Warfare by Jeffrey Carr from 2011. It's ancient, predating (AFACT) the rise of ransomware, and technically illiterate, but goes into considerable detail about the Russian cyber-crime/-war (they're the same, really) groups and their relationship to the government.

devnull3• 5 years ago

it was seeking to recruit partners and claiming that it combined the features of notorious groups like REvil and DarkSide

I wonder if they have leetcode style interviews :)

blankface• 5 years ago

reminds me of the Bin Laden interview(s) before 9/11, specifically the one with Robert Fisk where Bin Laden was saying he was going to start attacking America

https://www.bbc.co.uk/programmes/w3csvtth

https://www.cbsnews.com/pictures/osama-bin-laden-tora-bora/

btbuildem2• 5 years ago

I wonder why they refuse to rip off oil companies? Too well connected & therefore too risky?

caffeine• 5 years ago

Imagine if they shut down every Shell gas station or something similar.

btbuildem2• 5 years ago

I imagined more along the lines of them hitting Shell HQ and extorting the execs for millions and millions. Shutting down a corporate office seems a more likely scenario than hitting a multitude of effectively independent franchises.

nradov4• 5 years ago

Russia depends on oil revenue to survive. They don't want to put any part of that supply chain at risk.

GuB-42• 5 years ago

DS: What do you think about the attacks carried out against Colonial Pipeline’s infrastructure or JBS? Does it make sense to attack such large networks?
BM: We think that this was a key factor for the closure of REvil and DarkSide, we have forbidden that type of targeting and we see no sense in attacking them.

I think it is your answer, too risky.

unixhero• 5 years ago

So basically he interviewed a Romulan.

unnouinceput• 5 years ago

From last phrase: "...but we believe in our motherland..."

So yeah, a Russian.

flerovium• 5 years ago

This is free advertising for criminals.

Correction: this is free advertising for criminals _actively looking to recruit associates to assist them in committing crimes_, and helps them commit crime.

Don't upvote "Weapons Smuggling, Inc. (YC21) is hiring a coordination specialist for EMEA operations"

dcow11• 5 years ago

This is an interesting topic because BM claims to have a moral compass and is only interested in targeting wealth not impacting humans. Let me ask the question: “if companies paid for in-house security professionals competitive with what one might imagine BM pays, would people still choose the grey work?”. I presume in a dichotomy between clearly unethical and ethical, it’s easy for many to choose ethical. But when you add a grey option, it certainly changes things since I imagine most people are ethically grey. Let’s assume what BM is doing is effectively legal in the country where they operate.

pizza2343• 5 years ago

if companies paid for in-house security professionals competitive with what one might imagine BM pays, would people still choose the grey work?

Interestingly, they answer very clearly:

We have not been involved in legal pentesting and we believe that this could not bring the proper material reward.

They're in only for the money, so the answer is "yes".

Ransomware is not "grey" work though, if this is the implication; it's extortion, which is illegal.

dcow11• 5 years ago

Let’s assume what BM is doing is effectively legal in the country where they operate.

dylan6043• 5 years ago

would people still choose the grey work

some people are just outlaws and choose to do things because they are not allowed normally. so I'd say yes.

xh-dude• 5 years ago

I think it’s fair to assume that adding ethical gray is a well understood tactic in this world. And just that - a tactic.

nobodyandproud• 5 years ago

It’s not a moral compass.

It’s a rational decision: Their method of making money is to quietly and without a fuss extort money and have the victim pay.

Attention just brings heat to their operation.

sys_64738• 5 years ago

These people are terrorists so why are they being interviewed?

CleverLikeAnOx3• 5 years ago

It is not uncommon for journalists to interview terrorists and gangsters. I found it insightful.

imwillofficial• 5 years ago

Terrorists, cartels, and criminals of all shapes and kinds are often interviewed. As to the bigger question of “why”? It gives us a unique insight into a strata of society most of us are not privy to, opening our minds to new ideas.

pmoriarty4• 5 years ago

Know your enemy.

thrwyoilarticle2• 5 years ago

Moreover, LockBit encrypts the first 256 kb of the file (which is pretty bad from the point of view of cryptographic strength). We, on the other hand, encrypt 1 MB. Essentially, that’s the secret to their speed.

So I can just pad all my valuable data by 1MB?

dylan6043• 5 years ago

wouldn't it just be easier to have duplicate back ups of your "valuables"?

thrwyoilarticle2• 5 years ago

And yet the ransomware is successful.

jbverschoor• 5 years ago

Or just have 1 padded disk image you mount.. Emm no wait, that's be an fs, so they'd f that up too

mimixco3• 5 years ago

There's an elephant in this room and its name is ethics.

When I was a mainframe programmer at IBM, one of they first things they taught us was how to stop the processor of a System/370 machine. If you can do that, ladies and gentlemen, you can bring down Bank of America, the US Army, the Social Security Administration, etc. So everyone there knew how to be a "black hat" hacker if we wanted to.

Was there money to be made in that? Surely. More money than IBM ever paid anyone! But the reason neither I nor any of my colleagues would ever dream of using our skills to hurt people is that last part of the sentence: it hurts people.

Yes, IBM did some awful stuff from helping Nazis to keeping apartheid alive in South Africa (over employee objections while I was there), but overall, the "corporation" provided valuable goods and services to real people who had to slog on in real jobs every day to get the world's real work done.

Oil companies are in the same boat. The world runs on oil and some ransomware attacks aren't going to change that. The idea that terrorism (and black hat hacking is absolutely a form of terrorism) is a useful way to change corporate behavior is so ill-informed that it's pathetic.

When asked about taking a "white hat" approach and selling legal pen testing (or even PTaaS), these developers declined saying they probably couldn't monetize their skills at the same level that way.

Well, I say, too effin' bad. If everyone optimizes solely for himself, there will be no one left. It's appalling to me that criminal organizations now recruit, have price lists, and get PR placement. These people and their products (and their communication channels) need to be turned off ASAP for everyone else's sanity and self-preservation.

fleddr2• 5 years ago

What elephant in the room?

They are self-admitted criminals. They admit to be in a destructive industry to line their own pockets. The only reason they are selective in their targets is because critical targets will increase the chances of them being caught.

mimixco3• 5 years ago

I was referring mostly to the suggestions that attempted to justify this behavior by saying the targets are "bad companies."

dcow11• 5 years ago

These people and their products (and their communication channels) need to be turned off ASAP for everyone else's sanity and self-preservation

But they can't be because enough people don't share your worldview. Do you believe private communication is a human right? Well then you can't stop them communicating either. How would we achieve a world where these products and services could be universally banned immediately?

You are right, the problem is ethics. The problem is that it's not universally criminal to attack other countries' wealth.

If it came out that this group ran their infrastructure on IBM cloud, and you still worked at IBM, what would you do? It seems you think that the generation of wealth for IBM's shareholders is more important stopping genocide therefore it's okay to be complicit. So you seem to have some general notion of ethical total harm.

The idea that terrorism (and black hat hacking is absolutely a form of terrorism) is a useful way to change corporate behavior is so ill-informed that it's pathetic.

It does change behavior, though, whether you like it or not.

mimixco3• 5 years ago

I certainly can't argue that you're wrong!

Private communication, even for business, is a human right. I was not suggesting that some authoritarian arm "shut them off," but rather that a profusion of businesses and individuals simply chose to ignore them. Death by recission.

It's also one's right to choose to be in an ethical business or not. I've rejected many customers and employers because I didn't want to help in their aims.

I was among the people who protested IBM's continued involvement in apartheid and it did end before I left. Companies can chose to "not be evil" or they can just say that.

And yes, sadly, everything changes human behavior. What I was going for is that ethics is a practical phenomenon as well as nice one for other people. I still believe that more can be accomplished through volunteerism (including volunteer agreements about money and work rather than coercive ones) than through violence. Perhaps that's naive or hopeful but I hope a few of us persist in keeping the idea alive.

cutler• 5 years ago

Totally naive but what would it take to protect a disk from unintentional encryption or maybe make encryption impossible?

LadyCailin• 5 years ago

Good, offlined backups.

mod• 5 years ago

Make it read only

Interview with a ransomware group

Related Stories