Always strive to learn something useful. --Sophocles

I've posted about this guy before. When he wasn't able to get a good enough return from the therapy center for hacking them and stealing the files, he started trying to extort the patients to prevent their therapy records from being made public. He was finally convicted and received six years, three months in prison. Prosecution wanted a minimum of seven years, however he will be paying restitution and he will be held in prison while he goes through the appeals process, so they're satisfied.

https://krebsonsecurity.com/2024/04/man-who-mass-extorted-psychotherapy-patients-gets-six-years/

It's an interesting attack. Once infected, the malware sits there. It contacts a control server and asks permission to attack. When permission is granted, it goes into the Windows Registry and makes changes to prevent Remote Desktop from contacting the computer, so remote administrators can't get into the PC and try to stop the attack. Pretty clever move, that. Then it stops database services so that databases are available. Normally database services lock their databases so those files can't be wiped, stopping the services make them vulnerable.

THEN the wiper launches! It poses as a ransomware attack, launching a pseudo-random number generator, overwriting the files with gibberish and giving them a .cry extension, thus it is now known as the Cry Wiper. The random gibberish makes it look like the file is encrypted, but analysis of the code reveals that it's a random number generator, meaning that even if you pay the demanded 0.5 Bitcoin ransom, you're never getting anything back.

It's common in ransomware attacks to change the extension of the file so people can recognize that they've been compromised and the files are no longer what they were.

Another clever thing about this is that it automatically excludes program and system files: com, exe, dll, etc., so the computer will continue to run perfectly normally, but no data will survive. The articles that I've read don't mention if this will crawl across network shares or seek elevated access privileges, but they weren't very deep articles.

A similar program struck Ukraine earlier this year, probably launched by Russian hacker group(s).

No attribution to this attack has been found. Since no ransomware can be collected, even though a Bitcoin digital wallet is provided, that's probably a dead trail.

https://arstechnica.com/information-technology/2022/12/never-before-seen-malware-is-nuking-data-in-russias-courts-and-mayors-offices/

https://it.slashdot.org/story/22/12/03/0044234/new-crywiper-data-wiper-targets-russian-courts-mayors-offices

This is quite amusing and interesting.

Their bitcoin stash was seized and emptied. Their DDoS operation was seized: they used this to throw denial of service attacks at people whom they'd already hit with ransomware attacks who weren't paying up. Basically their infrastructure was taken from them and destroyed. No information who did this.

They closed up shop, and if I'm reading this article correctly, they released the decrpyt keys to everyone they'd encrypted but who hadn't paid yet.

Very strange things afoot.

One thing the article mentions is the "REvil Ransomware-as-a-service Platform." That's right, if you have the connections and the money, you can become a ransomware entrepreneur and go around perpetuating this shit and become rich and infamous. It is possible that the REvil people said 'No, you do not screw with major infrastructure, bad boys!' and had the means to tear them apart, or dropped a dime to law enforcement and turned them in. REvil is a pretty big org, and they certainly have the means to tear apart one of their franchise operators.

https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/


Colonial paid a $5,000,000 ransom shortly after the incident happened to try and restore service as soon as they could. And they received a working de-crypt key promptly. The problem is, with the high levels of encryption that these ransomware packages apply, decryption of vast levels of data take a long time, so Colonial also started doing restores from backup while also decrypting, attacking the problem from two points at the same time.

There are multiple problems with ransomware, paying it or not. If you don't pay it, you have to rebuild your infrastructure from scratch and hope your backups are good. Smart people in IT have a saying that we're fond of that that if you don't test your backups by doing a restore, then you don't have a backup. And a lot of companies that get hit by ransomware all of a sudden find out that they don't have backups. I worked with one such company that got hit by ransomware: turns out they'd been having backup problems and just couldn't be bothered trying to resolve them, too busy.

Plus, the criminals have developed another layer to their model. They have to infiltrate your network to place the encryption software and launch it. So while they're there, they hit your email server and documents directories and exfiltrate that information, they also look for corporate secret stuff like blueprints and things. Lots of companies have secrets that they would rather were not exposed to the light of day, like that $1,000 gadget that everyone is buying that only costs $75 to make, or the CEO's perversity for 14 year olds? Things like that. So if the company doesn't pay the ransom and starts rebuilding, they then come back and double the ransom demand and threaten to dump this dirty laundry in the open press.

And then there's the problem with those that pay and become the victim of poor-quality criminals. They don't hear from the criminals and don't receive a decrypt key or program, or the key will not work, or they demand another ransom and it turns into escalating extortion.

The REvil people try to keep the criminals using their service operating professionally so that if you're hit by a REvil ransomware infection, you know that if you pay the ransom, you'll get your data back. I think it's a good chance that REvil took down DarkSide or dropped a dime and provided critical information for DarkSide's downfall.

We might know some day.


I'm not writing a lot about cybercrime because it's just too damn common. I could spend all my waking hours writing about it, just like I could spend all my time writing about politics. It's just not worth it. I quit working in IT, and I'm staying quit, though I'm still keeping abreast of some of the better blogs and web sites.