The fact that the employee can't publicize the windfall means that the gang has no incentive to pay them, either. The employee can't exactly complain to anyone that they got stiffed.

It's a sort of prisoner's dilemma problem - since the game won't be repeated with any single employee, and there's no communication between employees, the gang gets a better outcome in all cases by not paying.

I'd bet on the employee getting scammed too.

I've worked with enough disgruntled employees to know that many of them would anything to hurt their company, even if there was no compensation for them. The secret is to hit them at a low point in their day.

> The secret is to hit them at a low point in their day.

You don't even have to time it perfectly. In six months, when they're most upset and seeking revenge they'll remember the email

The only way people would reliably help with the sabotage is if the group had a reputation for paying out. Kind of the same way ransomware works already- if nobody gets their data back, people will be advised never to pay

I strongly disagree based on my experience consulting and the countless articles you can find about this very situation happening prior to the rise of cryptocurrency and ransomware gangs. Disgruntled employees doing shift+delete on a critical directory after missing backups or rotating encryption passwords to gibberish on their last day is very common. (or of course both and more)

For me it's not hard to believe at all that someone who is already at a low point and motivated with malicious intent would read up on such an offer and think to themselves "I can screw my boss __and__ get a cool million in etc? Just for 'accidentally' uploading some ssh keys with a misplaced wildcard?"

Even before the covid pandemic, stress in IT was high and disgruntled employees doing damage on the way out was making headlines. Search 'Disgruntled employee destroys data' on google and check the date of some of the news articles. Here's one that made US national news in 2014 about how data theft was a trend.[0]

Whether or not there's a real payout is of no consequence it seems. I'm only able to immediately find articles about such incidents in the US and the UK, but I am fairly sure it's not limited to such locations, or that outsourced IT isn't just as vulnerable.

I've written it before on HN for other reasons, but people like to talk about new laws/standards/etc, but IT doesn't have problems that need legal solutions, as an industry, IT needs to improve discipline across the board and stop letting situations where one person can be so destructive happen. Too many places still run their IT like it's the 80's/90's where one or maybe two with absolutely control over everything. This leads to burnout first of all, which is horrible, but it also creates these bad situations of unregulated control in the first place.

[0] https://www.wsj.com/articles/fbi-warns-of-rise-in-disgruntle...

> I've written it before on HN for other reasons, but people like to talk about new laws/standards/etc, but IT doesn't have problems that need legal solutions, as an industry, IT needs to improve discipline across the board and stop letting situations where one person can be so destructive happen. Too many places still run their IT like it's the 80's/90's where one or maybe two with absolutely control over everything.

I mean, it's like having the neurosurgeon at the hospital retire/quit for a software company to lose it's IT.

The issue is, many software companies don't know/think they are a software company.

Unless some employees get caught, there's no way for the group to acquire this reputation. Certainly they can't be trusted at their word ("we pay out" - sure you do).

So pay out, then anonymously rat out their own inside man to the feds?

Ugh feels so dirty even saying it, I guess that's why sociopaths win so often.

"we paid that guy and he got caught"

"we paid this other guy and he got caught"

"come join us!"

There is a huge incentive for ransomware gangs to pay out to employees: So they can hack them again.

Many companies that get hacked get hacked again anyway. With the help of an insider, an attacker could more effectively around any new countermeasures, too.

https://www.zdnet.com/article/lightning-does-strikes-twice-i...

On the other hand, it might provide new opportunities, I would say that an escrow service for this (hypothetical) payment of the (promised) 40% share might represent a new kind of service in demand.

I feel like you could just set it up with a smart contract. No need for anything special, if payment is received, you automatically get your cut.

I've never understood the nitty gritty details on how that's supposed to work. Certainly you'd still need both parties to tell the contract that the work was done, right? Otherwise, just one party acting fraudulently could release the funds to the wrong person.

I think this would just rely on the ransomers to have the ransom paid to the correct address, which would be tied to a smart contract that'd take care of divvying up any money coming in and forwarding it to other addresses. If money comes in, the work was done, so distribute it, all automatic.

Aside from bugs in the contract, or opsec concerns, the main risk (for the saboteur) would be the ransom folks directing the victim to pay some other address that wasn't part of the smart contract, so no money ever comes into it. Really, it's only marginally more reliable than just depending on them to pay you when they get paid.

That is interesting, how would the employee trust that the criminal organization would indicate the correct address (that triggers the smart contract) to the hostage company?

That's the part that makes it only marginally better than just counting on them to manually forward the money. The only advantage is you skip the part where they already have the money but have not yet betrayed you, and are looking at a huge figure already in their own account and maybe contemplating not sending any of that to you. They can still just have it sent to the wrong place to begin with. Since it'd be easy to fake fulfilled contracts (make sure you own all addresses the contract disburses to) completed contracts, even if publicly visible, aren't even very good for building a reputation for paying out. You might just be paying yourself at multiple addresses, to make it look like you reliably pay out rewards.

I wonder if you could use something on the target’s network as an oracle. “This smart contract will pay out when presented with a Kerberos ticket signed by a target.example.com Active Directory server granting Domain Admin privileges.” (This particular formulation has some obvious holes, but you get the idea.)

Yes, there in smart contracts there are things called "oracles" which are like 3rd party indicators or sensors that something happened. I don't see how anyone besides the hackers could indicate that.

Exactly. Future of France over here.

So the criminals can get the ransom, then offer the id of the colluders in return for a further ransom!

I don't think so. The success of this would all hinge on an un-easy trust between the organizers and the individuals. Backstabbing your partner would ensure that you would never get anyone else to do this for you again. That would be the end of your operation. You need the world to know that yes people really do this for you, and yes they really do get paid.

A similar dynamic is at play between ransomware attackers and their victims. Why would ransomware attackers restore files from a successful attack after the ransom is paid? Easy. The attackers need the world to know that paying the ransom will work, otherwise no one would pay it.

It is odd watching a bunch of people who effectively deal with rules all day try to predict behavior for a group of people who effectively ignore rules all day.

Why is a ransomware company going to follow the rules of common decorum when dealing with a collaborator if the whole point is to defraud a third party?

How do I know that they made the payout? Is the collaborator going to come forward and identify themselves? The only way you know that person got paid is if they don't get arrested. There are whole branches of organized crime than live and breathe in the space between 'got paid and lived happily ever after' and 'ended up on the front page of the NYT'. Just off the top of my head you have blackmail, extortion, and hiding the body.

We aren't invoking the ethics of "rule-following" to explain why criminals behave certain ways, rather we are speculating on based on incentive alignments and rational self-interest. The answer to your question is quite simple: because they need third parties to work with them. There are lots of ways as to make past history of payouts known without releasing who the individual collaborators were in each case.

No. Not even close. This isn't 7-11 trying to con me into buying their scary hot dogs, these are bad people, in all senses of the word.

They need third parties to think that working with them is their best option. Their best option is to do something legal, but desperate people can be manipulated. Greedy people can be really manipulated. Maintaining the illusion of safety is just marketing.

If the game is extortion, then psychological manipulation is part of the game. I have no assurances that you've given me $1.4 million today and this is the last I will ever hear from you. If I know little about you I can't even turn State's Evidence to save my ass if I get caught but you don't. If I think I know that you or anyone with details of your operation won't come back later and threaten to turn me in unless I pay you money, then I'm a fucking idiot. You could ask for money, or to "deliver a package" for you. In that situation, what you and your associates are counting on me forgetting is that I am mortgaging my future by piling on new crimes with later statute of limitations dates, and establishing a pattern of behavior that makes me look even more complicit.

There is no honor among thieves. Stop trying to figure out how to pet a wolf without getting bit.

You missed something fundamental there about the difference between the two scenarios that drastically changes the optimal play.

Victims of ransomware are public and will publicize if they don’t get their files back. An individual willingly trying to compromise their employer’s network is not going to publicize not getting paid because it will get him/her arrested.

> An individual willingly trying to compromise their employer’s network is not going to publicize not getting paid because it will get him/her arrested.

They will anonymously post on the message boards dedicated to ransomeware gangs that this particular gang is not reputable. Like leaving a Yelp review, except even more trustworthy because it's a relatively tight-knit community.

It would only work out for the gang if the ransom was enough money they decide to "retire" and not pay out. In all other situations, they need their reputation.

> They will anonymously post on the message boards dedicated to ransomeware gangs that this particular gang is not reputable.

And why would someone believe an anonymous post? Don’t you see the problem here?

Most folks will follow this approach - but it's not guaranteed. Some of the attackers will betray their victim and ride on the goodwill garnered by other attackers to make their strategy sustainable.

The ransomware group does not need to know the identity of the disgruntled insider.

A problem (for the criminal org) might be that if an employee is willing to follow the customization steps for the ransomware and deploy it in order to receive a share of the ransom, it might not be much more difficult or illegal for the employee to just do everything by themselves and receive all of the ransom, cutting out the criminal org completely.

I think it's more realistic that baddies pay employees to see some of the juicy data in the company db. Lower(but not 0) risk of detection.

Even better as sabotage - Make a public offer to your competitor, then watch their org implode in a cloud of suspicion

Make it a fire and forget hidden installer on any usb-port and the world ends today.

Basically affiliate cracking! That's an idea!

Sounds like something HR would try

honey pots would make counteracting them very effective