WanaDecrypt0r Ransomware Earns Just $26,000 In Ransom Payments (krebsonsecurity.com)

An anonymous reader quotes Krebs On Security: As thousands of organizations work to contain and clean up the mess from this week's devastating Wana ransomware attack, the fraudsters responsible for releasing the digital contagion are no doubt counting their earnings and congratulating themselves on a job well done. But according to a review of the Bitcoin addresses hard-coded into Wana, it appears the perpetrators of what's being called the worst ransomware outbreak ever have made little more than USD $26,000 so far from the scam...

It's worth noting that the ransom note Wana popped up on victim screens (see screenshot above) included a "Contact Us" feature that may have been used by some victims to communicate directly with the fraudsters... I find it depressing to think of the massive financial damage likely wrought by this ransom campaign in exchange for such a comparatively small reward.

Comments

Re: Good.

[Entrope]

Has that stopped bank robbers?

Criminals are not known for having the world's best impulse control or understanding of expected itchiness.

Re: Good.

[jellomizer]

Bank robbers are not in it to make a load of money unless they are planning to break the vault. Normally they are just trying to get some cash to pay for drugs or a loan shark.
But compared to deploying a wide scale attack, a normal bank robbery doesn't require a lot of planning, unlike the a technical attack where there is days of planning.

Re:What was the ROI?

[jellomizer]

There is the cost of getting caught. A multi-national attack hugging big organization will have a lot of people out for blood. Just hitting one or two areas you may get some jail time, but if this guy gets caught he is in serious trouble.

I normally like Krebs, but...

[dreamchaser]

"However, I find it depressing to think of the massive financial damage likely wrought by this ransom campaign in exchange for such a comparatively small reward. "

This is the most idiotic statement I've ever seen him make. It is a good thing if there was little reward, and his implication that he is disappointed that they didn't get more is just mind boggling.

Re:I normally like Krebs, but...

[Zocalo]

I think you're looking at it from a different perspective to Krebs, although I agree that the wording could have been better. My impression is that he's saying he's depressed that those responsible would (presumably) consider the massive cost of cleaning this up for those impacted as collateral damage for their relatively meagre $26k return. Of course, other than the raw numbers, that's no different from any other legal industry where profits rely on basically screwing over others in order to make a buck; you could just as easily level the same charge at any industry with a significant environmental impact, for instance.

Re:I normally like Krebs, but...

[chill]

Agreed.

I think Krebs means "if they're willing to cause this much grief for so little return, we don't have much hope of economics ever stopping these attacks".

The ROI on this is probably insignificantly low, so we're stuck with this sort of shit.

Rewarding bad behavior

[markdavis]

This is why we should ever pay ransomware.

1) There is a big chance they are not going to unlock your data, anyway.

2) You don't know if they have also stolen all the data and can then do other things to harm you in other ways. Or left residuals in your computer.

3) By paying, you are a "mark" so they might go after you again.

4) Paying absolutely encourages them to continue this behavior and incentivizes others to joint them.

We need to educate everyone: Backup your data redundantly and check it regularly, and don't pay ransomware.

$26k seems like a good ROI

[mark_reh]

Until you factor in trying to hide from the FBI/Interpol for the rest of your life. Are you sure those transactions are completely untraceable? Yeah, sure, keep telling your self that. Sleep well...

The real question is...

[Excelcia]

The real question is why isn't the NSA getting its feet nailed to the floor for this? They discovered (or engineered) a critical weakness in a major operating system, and rather than report it to make sure we are actually safe from this threat, they used it to make malicious software which then got released into the wild and is being used against the world.

This is the largest breach of trust of any US government agency that I know of, and yet people are just ignoring that aspect of it.

Re:What was the ROI?

[arth1]

Cost to those scammed: huge, potentially millions and maybe a few lives lost or harmed â" it hit quite a few hospitals; not that the scammers really care what it cost other people.

There are also some benefits to society, like boosting emergency preparedness. This has clearly shown how NHS in particular are overly dependent on computer systems, to a point that hospitals can't operate when systems go down. How would they be able to handle a real emergency, like a war?

Nobody knew, or those who did didn't say anything. Now everybody knows, and there's a chance of vulnerabilities being scrutinized and contingency plans made and tested.

Fuck the money, what about the DEATHS?

[CFD339]

People in hospitals did not get care due to this. There was at least one critical stroke response unit that had shut down complete. Medical equipment also relies on computers, some of which were vulnerable. You want to blame the "victims" for un-patched systems? Sure, all systems should be up to date, but that's a bit like blaming the victim of a stray bullet from a gun fight for not wearing combat armor when he went out for a sandwich that day.

Re:Fuck the money, what about the DEATHS?

[Anonymous Coward]

I don't agree with this.

My guess is why they get caught with this sort of thing so often is their systems are probably frequently using outdated operating systems where they simply can't get patches any more as they're no longer supported. When a piece of equipment costs a million to buy, you're going to use it as long as possible. And when you bought it in 2005 when Windows XP was the latest and greatest, and the manufacturer never released a version of their software for new versions (maybe they went out of business), is the hospital supposed to upgrade it and just hope that the software keeps running? No, the system will just go unsupported.

The only thing I can think of that's reasonable for hospitals to do that they don't is to keep this sort of machine isolated from the internet. But again, hospitals are in the field of medical help, not IT, so it can be expected that their IT infrastructure may not be the best. And if you think they should be held responsible for not having good IT, well, assuming you're specialty is IT, should you be held responsible for your inability to provide quality medical care?

Too many people with nothing to lose

[rsilvergun]

there's lots and lots of engineers in China, India & Eastern Europe without much to lose. Their economies have little to no safety net, meaning if you trip up you crash hard. This is one of those consequences of abandoning a good chunk of your population to the forces of nature and the whims of capitalism. There's talk about the US slashing aid to poor middle eastern countries and of Isis et al looking forward to it so they can move on and radicalize the desperate. On a more local scale stuff like this is why we have WIC, so we don't have millions of babies with mental and physical disorders from their developing years.

I know, I know, I'm politicizing. But the thing is like it or not politics affects everything we do. It's scary how far it's embedded in our lives and nobody likes to acknowledge it...