Ransomware 'customer support' Chat Reveals Criminals' Ruthlessness

Ransomware criminals chatting up victims, offering to delay deadlines, showing how to obtain Bitcoin, dispensing the kind of customer support that consumers lust for from their cable and mobile plan providers, PC and software makers?

Finnish security vendor F-Secure recently released 34 pages of transcripts from the group chat used by the crafters of the Spora ransomware family. 

The back-and-forth not only put a spotlight on the gang's customer support chops, but, said a company security advisor, illustrated the intertwining of Bitcoin and extortion malware.

"We should be thankful that there are at least some practical barriers to purchase Bitcoins," wrote Sean Sullivan of F-Secure in a post to the firm's blog. "If it were any easier to do so, very little else would check the growth of crypto-ransomware's business model."

Sullivan originally penned that conclusion last month, in a short section of the "State of Cyber Security" report that F-Secure published then. Yesterday, F-Secure posted the transcripts, 20,000 words or more, and dubbed the collection a "new supplemental appendix" to the original report.

In one exchange, a Spora victim said he or she had paid the extortion fee, but had gotten nothing in return. "I already sent you 98USD worth of bitcoin," the victim reported.

In response, the "customer support rep" blamed the victim for entering an incorrect Bitcoin destination address. "But do you agree, that it is you mistake, that you entered incorrect address?" asked the Spora rep.

"I literally copied the address that was given at the refill page. How could I be mistaken?" the victim replied.

In one of many similar threads, the transcripts identified each victim by the first character of the ID created by the ransomware, someone pleaded for mercy.

"Hello crooks. I agree to pay," said "0" in a lead-off message. "But 570 dollars for a lot of photos of my grandmother. Can I expect a discount if I leave good feedback on the forum about you?"

No go. "We do not provide any discount. Also, we cannot be sure, that you have only photos," retorted "support."

At times, the messages were pitiful. "Hello, I am 82 and my family pikture  go away -- bad, very bad," reported another victim identified as "0."

"Is anyone there?" asked another during a stretch when Spora's support didn't respond to scores of messages, apparently borrowing another tactic from legitimate technical support desks.

Others played the anger card, the profanity card, the sympathy card. "Am I the one you should hack? No. I am just a salary man who tries to make ends meet and bring foods to his kids," said "E," who also identified himself as "Mustapha from Morocco.

But as F-Secure's Sullivan noted, many the questions posed to the hackers involved Bitcoin. "Hello, I am from Greece and we have capital  controls, is there any chance of a discount? Am having trouble buy bitcoins from here," remarked one.

"I'm going to pay for bitcoin. But I'm not sure that it works in weekend. Can you remove deadline please? If not works I will pay it on Monday," pleaded another.

The answer from Spora was always the same: No discount. The "rep" often extended deadlines, however, sometimes in response to victims pleading poverty, telling them that when they had the full amount, come back and pay.

"The malware technology to encrypt data has been possible for many, many years; the bigger challenge has always been getting paid," Sullivan pointed out. "In the past, cyber-crime schemes (such as scareware) have been killed off by disrupting the money supply.

The same may well be true of cyber extortion; to kill the business model, it may be necessary to ban Bitcoin."

Computerworld

You Might Also Read:

Would Killing Bitcoin End Ransomware?:

Digital Forensics, Incident Response & Attribution:

Both Police & Business Must Deal With Cyber Extortion:

How To Deal With The Rising Tide Of Ransomware:

 

 

« Russian Cyber Warfare:'Victory in Syria'
TeamSpy Malware Returns to Steal Data »

Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

DigitalStakeout

DigitalStakeout

A simple and cost-effective solution to monitor, investigate and analyze data from the web, social media and cyber sources to identify threats and make better security decisions.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Cylance Smart Antivirus

Cylance Smart Antivirus

An antivirus that works smarter, not harder, from BlackBerry. Lightweight, non-intrusive protection powered by artificial intelligence. BUY NOW - LIMITED DISCOUNT OFFER.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

MetaCompliance

MetaCompliance

MetaCompliance is a cyber security and compliance organisation that helps transform your company culture and safeguard your data and values.

GlobalSequr

GlobalSequr

GlobalSequr is an IT security consulting firm. We have a goal of demystifying the complexity of IT security.

Cyber DriveWare

Cyber DriveWare

DriveWare analyzes new traffic in the I/O layer and blocks malware and cyber attacks which organizations have no means to protect against.

TechGuard Security

TechGuard Security

TechGuard Security was founded to address national cyber defense initiatives and US critical infrastructure security.

Information Systems Security Partners (ISSP)

Information Systems Security Partners (ISSP)

ISSP is a specialized system integrator focused on the information security needs of its corporate clients and providing best in class products and services for securing organizational information.

Acceptto

Acceptto

Acceptto offers the first unified and continuous authentication identity access platform with No-Password.

Uptycs

Uptycs

Uptycs combines the open source universal agent, osquery, with a scalable security analytics platform for fleet visibility, intrusion detection, vulnerability monitoring and compliance.

AGC Networks

AGC Networks

AGC Networks is a Global Solutions Integrator representing the world's best brands in Unified Communications, Data Center & Edge IT, Cyber Security and Digital Transformation & Applications.