News for hackers. Stuff that matters.
Re:Instructure Pays Ransom to Canvas Hackers by AlotOfReading on Tuesday May 12, 2026 @01:42PM (#48111619)
I'm not sure that attacker reputation is particularly meaningful. The group can rebrand into a new identity at any time. They're anonymous cybercriminals after all and there are lots of reasons they might need to do that beyond reputation laundering.

The calculus for the victims doesn't seem to change much whether the same people are using a "new" name or an old one to hold their systems hostage.

Re:Instructure Pays Ransom to Canvas Hackers by applfanboysbgon on Tuesday May 12, 2026 @02:06PM (#48111956)
> I'm not sure that attacker reputation is particularly meaningful. The group can rebrand into a new identity at any time. They're anonymous cybercriminals after all and there are lots of reasons they might need to do that beyond reputation laundering.

It is very meaningful. You seem to equate that "new" = "trust by default", but a new group is distrusted by default. Let's say that for a new group which is unproven to hold up their end of the deal, only 5% of victims will pay the ransom. But if you've built up a reputation over 5 years of honoring your ransoms, then maybe 50% of your victims will pay the ransom. Reputation is literally everything here. I doubt Instructure would have paid such a high-profile ransom if they didn't have a strong reason to believe it would work.

Re:Instructure Pays Ransom to Canvas Hackers by Ancapistani on Tuesday May 12, 2026 @03:09PM (#48112919)
Agreed.

This is the same problem that crypto addresses in an unregulated market - it provides attestation and continuity, but not much else.

New actors are untrusted. Trust must be built through small transactions until someone trusts you enough for larger transactions. Survive long enough without major reputational harm and you can even offer to act as an escrow service for parties with less trust.

Re:Instructure Pays Ransom to Canvas Hackers by Freak_NL on Tuesday May 12, 2026 @02:01PM (#48111878)
The name ShinyHunters is currently quite well-known due to a number of high-profile hacks (Odido in the Netherlands this year was huge). Their brand has a significant value right now.
Re:Instructure Pays Ransom to Canvas Hackers by jasonfarnon on Tuesday May 12, 2026 @07:41PM (#48116017)
How does everyone know its ShinyHunters and not someone pretending? I imagine they have some mechanism to authenticate, I'm curious what it is.
Re:Instructure Pays Ransom to Canvas Hackers by HDBaseT on Tuesday May 12, 2026 @07:50PM (#48116084)
Because ShinyHunters published they hacked Canvas on their own website. They also redirected the canvas login pages to a ShinyHunters message, whilst this could be done by another group/person, its unlikely.

You can also validate PGP keys and TOX accounts, etc via their website.

Re:Instructure Pays Ransom to Canvas Hackers by jasonfarnon on Wednesday May 13, 2026 @01:26AM (#48118172)
OK, I didn't realize they had a stable website all this time. I guess it's all out there in the open with these groups.
Re:Instructure Pays Ransom to Canvas Hackers by onemoresoop on Tuesday May 12, 2026 @01:46PM (#48111673)
Yeah but fewer ransomes would be paid out regardless of who is attacking. They could be spoiling their own market and am sure they would
Re:Instructure Pays Ransom to Canvas Hackers by AlotOfReading on Tuesday May 12, 2026 @01:55PM (#48111778)
That's a motivation to avoid tragedy of the commons, not because they're trying to maintain their own reputation to victims. It benefits the criminals even if they change their name.
Re:Instructure Pays Ransom to Canvas Hackers by esseph on Tuesday May 12, 2026 @02:19PM (#48112158)
> I'm not sure that attacker reputation is particularly meaningful. The group can rebrand into a new identity at any time.

Reputation is everything in a collective.