It's amazing to me how brazen the ransomware scene has become. The fact that they are now going after law enforcement agencies shows extreme confidence in their ability to evade prosecution.

And I know the DC police force doesn't have global jurisdiction to root out cyber attackers, but the 3 letter agencies that do have this jurisdiction may view ransomware in a different light after this attack.

These type of ransom seems to be state backed or at least tolerated.

That has long been suspected. I can't prove it, though I wouldn't be surprised if the big Agencies had proof and no ability to do anything about it.

North Korea conducts low-level cybercrime to fill the state's coffers and geopolitics. They are like vikings; raiding an enemy and stealing all they can while they're there to keep the lights on. Hackers from Russia or China are higher up on the hierarchy of needs and attack targets for geopolitical advantage.

Just because someone is hacking from Russia doesn't mean they are working for the FSB, or are doing it for non-commercial reasons.

People who live in other countries aren't just mindless drones that march in lock-step with their ministry of foreign affairs.

>Just because someone is hacking from Russia doesn't mean they are working for the FSB, or are doing it for non-commercial reasons.

That's why the reply a few comments up the chain said "These type of ransom seems to be state backed or at least tolerated."

"At least tolerated" part means that the hackers are doing it for their own purposes or for money, but not under command or employment from foreign federal agencies. Foreign federal agencies simply tolerate those hackers by looking the other way, since no skin off their backs for some ransom payments taken from some US entities.

What I am responding to in the grandparent post is:

> Hackers from Russia or China are higher up on the hierarchy of needs and attack targets for geopolitical advantage.

That is a completely different claim from what you are talking about. The throwaway account claims that foreign hackers are all political agents. (Which is an incredibly broad generalization to make about an entire country, that strips its residents of their agency, and would require extraordinary amounts of evidence to support.) Your statement does not support that interpretation - it argues that they are economic agents that are tolerated/encouraged/whatever by the political apparatus.

Your claim is compatible with mine. The throwaway account's, on the other hand, isn't.

Yes, and the comment comparing NK to vikings pretty clearly threw away the "at least tolerated" part of the comment above it.

> extreme confidence in their ability to evade prosecution.

Their ability to evade or the lack of ability of Western countries to deal effectively with them?

Then you read how the ransomware groups "avoid" CIS countries, well I wonder why...

And the heads of these states hold massive wealth in the West. Funny how they want to "destroy" the West just a little.

What is a CIS country?

CIS is the not-Soviet Union.

https://en.wikipedia.org/wiki/Commonwealth_of_Independent_St...

How would that work though?

The group demanding the ransom can freely set their price. Surely if they know an insurance company is on the hook for it then they’ll add a few zeroes accordingly, making it impossible to underwrite.

Most ransomware groups just want the money; they don't particularly want to inflict damage on their target. If their demand falls within policy limits, then they will very likely get payed. If their demand exceeds policy limits, then the target needs to make a much more active decision about weather or not to pay. Combined with the fact that exceeding the insurance limit likely puts you into a realm where you are asking for a some large enough to be a significant challenge (otherwise they wouldn't have bothered with insurance), and you are now reducing the likelyhood of getting a payout.

I would expect the net result of this would be that groups raise their demands to match what (they think) the policy limit is.

From what I understand, ransomware insurance is already a thing. With the policy you get someone who negotiates the price and pays the ransom directly to the ransomware gang, which bypasses some laws against paying ransomware directly.

In theory, this helps with lower prices, negotiated support policies with the ransomware criminals to ensure the decryption process goes well, and they keep cryptocurrency available so the policy holding company doesn't have to scramble to get millions of dollars in crypto in a day or two.

Similar to kidnapping negotiators, ransomware negotiators often have the experience to produce a better outcome

It would work by the "insurance" paying off established ransom groups in advance. Protection rackets aren't exactly a new invention. Wether it can work or not is entirely hinging on the uncertainty of just how fragmented the ransomware industry really is. Is it actually just one loose federation or are multiple ecosystems existing in parallel? Do they perhaps informally agree on virtual turfs?

There was an article or discussion I believe I read on HN that discussed how kidnapping and ransom insurance reduced violent outcomes and made dealing with the kidnappers more predictable.

True, but what has made kidnapping mostly disappear is laws that make it illegal to pay a ransom. That makes it impossible to ask for help (as the police are more likely to find out) raising the ransom, and thus the total paid much less.

Nothing is perfect, but when there is no money in the crime there is much less crime. (Don't confuse less with zero!)

Sure, but GP was asking about how insurance might work. Also, I'd thinnk making lowering ransoms (by making it illegal or other means) works only if it's paired with a low probability of the kidnappers being able to enjoy the proceeds.

Where is it illegal to pay a ransom?

Kidnap, ransom & extortion insurance have been around for a while. I imagine that whatever solution those industries employ would work here. I'm also curious what that looks like, though.

Here's how I imagine it: The policy would insure up to a certain dollar amount, say $20 million, and pay directly to the insured in the event of an attack. If the ransom demand is $50 million, the insured can either pay the remaining $30 million on their own or use the $20 million to begin to repair the damage to their systems.

It exists already, yes.

My company was attacked relatively recently and our local servers were all encrypted. All we had to do was contact our insurance provider and they handled the investigation and negotiations with the group. A day or two later and our files were back.

One aspect is that a bunch of ransomware actors are on US sanctions list, so paying money to them - for whatever reason - is a felony i.e. "funding terrorism" even if you don't know at the time who is behind them.

Yes... and it is a growing part of commercial property insurance: https://www.fmglobal.com/products-and-services/products/cybe...

Yes, most Cyber Insurance covers Ransomware. It's been a huge driver of claims and claims cost in the last couple of years for insurance companies.

The ransomware industry is actually in the midst of a big shift. As ransomware becomes more prevalent, ransomware insurance providers are charging more and paying out less.

A lot of companies either can no longer afford the insurance, or else it has become expensive enough that it doesn't make any sense to purchase.