Re:Massachusetts Steamship Authority hit by ransomware attac...
by akiselev on Wednesday June 02, 2021 @04:00PM
(#27373358)
> How many of these attacks are fully automated in the initial attack/encrypt phase vs. human operators explicitly working to more fully infiltrate a target?
Given the effectiveness of social engineering in hacking's history, that's a very good question. I wouldn't be surprised if randomized attacks are used to create a "sales funnel" of high value targets with poor IT ops/outdated equipment/etc that can be exploited for big payouts. All it takes is a few hundred or thousand dollars to bribe a low level employee so the vast majority of the cost is likely in finding targets. Once they've identified a target, the exploitation process is probably mechanical.
Unencrypting for vicitims in the US that couldn't pay would just add more exposure risk to them of getting caught, so they would have no incentive to actually do it. It would take a large bit of money out of the system, but it seems like you need all countries to coordinate and that one country doing so on its own, enforcing a no pay out rule, won't have much effect on non-targeted attacks.
How many of these attacks are fully automated in the initial attack/encrypt phase vs. human operators explicitly working to more fully infiltrate a target?