Thousands locked out of their computers unless they pay up.
The threat actors were asking for millions of dollars.
The single largest global ransomware attack on record.
Threat actors will use all kinds of tools
to try to get the victims to react.
I want to update everyone on the ransomware cyberattack
that impacted on the Colonial Pipeline
over this past week.
Each day of the outage, we saw more hoarding, more panic buying.
Healthcare, education, charities, small businesses,
all the way up to Fortune 500 companies.
I made the decision to pay,
and I made the decision to keep the information about the payment
as confidential as possible.
TV stations, food and fuel suppliers, hospitals, water systems.
Everyone’s a target.
It only takes one person clicking a bad link.
It’s not a business transaction. It’s not a negotiation.
It was the hardest decision I’ve made
in my 39 years in the energy industry.
We don’t want to pay these threat actors either.
It does, in fact, incentivize them to perpetrate more attacks.
[SUPER_USERS]
[RANSOMWARE NEGOTIATOR]
My name is Kurtis Minder,
lead ransomware negotiator at GroupSense.
A ransomware negotiator acts as a liaison between a ransomware victim
and a threat actor
and ensures that we pay as little as possible.
In traditional negotiation, we rely on the fact
that your opponent is possibly sitting in front of you
and that you can read tone, body language, make eye contact.
Otherwise you are talking to them on the phone,
and you can hear their voice.
That is not the case here.
We’re talking to threat actors over the dark web in a chatroom,
so we can’t read any body language or tone.
Keep in mind that the threat actors often have copies of your finances.
They know how much money you make.
They might have a copy of your cyber insurance policy, for example.
So those things are a tremendous amount of leverage.
So being able to operate effectively
in a negotiation where all of these things are true is very nuanced.
It’s high stakes,
and oftentimes the options are go out of business, pay a ransom.
So what it’s like to be a ransomware victim is
you come in one morning to your office, and nothing works.
None of your machines work. You can’t access your email.
Somewhere on your machines,
you’re going to find a text file, usually on the desktop.
That URL that they have put in that ransom note
is custom to you.
Should you go to that URL, they know it’s you.
And the minute you go there,
there’s a clock in the upper left hand corner.
As soon as you go to the site, clock starts ticking down.
There's usually a couple of threats attached to that clock.
“If you do not pay us before the clock reaches zero,
we will double the asking amount.
We will delete the decryption software,
and you will never get your files back.”
These are all methods for them to try to speed up the process,
create a false deadline.
All of these tactics come together and create a sense of fear and panic
and time crunch to get you to pay quickly.
Interacting with the threat actors
on the dark web’s victims site they provided in the ransom note
is just like a regular chat room or text message
with the bubbles between you and threat actors.
It is, quite literally, live chat.
And often, they’re sitting at their window waiting for you to respond.
As you’re nearing the end of the transaction,
you’re going to be given a cryptocurrency wallet.
Once you get that wallet,
you're going to need to learn how to transfer your traditional currency
into cryptocurrency and make a payment.
The threat actors or bad guys
often even offer some form of technical support,
both on how to do the cryptocurrency transaction,
how to acquire the cryptocurrency, etcetera,
but also how to use their software to decrypt your encrypted files.
On the large side, we’re dealing with tens of millions of dollars
at the initial asking price.
We have settled as low as sub 1,000 for smaller companies.
The 20s [million] is probably the largest that we’ve dealt with.
Does the government have any idea who’s doing this?
You know, they do.
And just last week, we saw an indictment
by the Department of Justice of six Russian intelligence officials.
They actually named the individual Russians
whose fingers were on the keyboards during cyberattacks.
One of the attacks was a hospital in Western Pennsylvania,
where computers that control things like cardiology and surgery
was badly hit.
Roughly 80, 85 percent of the attacks
are emanating from Belarus, Russia, Moldova.
There are attacks that emanate from Iran, China,
South America, Latin America,
but most of them are coming out of Eastern Europe and Russia.
This is a team of people working together.
They've got a financial department. They've got negotiation department.
They've got a customer service group.
Most of these organizations are pretty sophisticated.
These are not hackers in someone’s basement.
This is run very much like a regular business.
It’s not uncommon for the person you’re working with
to say something like,
“I can’t approve that. I have to get approval from my manager.”
One of the hardest parts about our job is dealing with the victims.
We saw a trend where they were attacking nonprofits.
A charity that’s been hacked pleads,
“Please, if you can assist and allow us to continue our work.”
In one case, we were working with a cancer charity.
The threat actors came back and said,
“Well, what do you think would be a reasonable amount?”
And we said, “Zero would be a reasonable amount.
What are you talking about?”
And they offered back a small sum in the tens of thousands,
far off their million-plus ask, and we settled.
When you're dealing with small businesses,
you're often dealing with individual operators.
Sometimes they’ve built the company themselves,
sometimes they’ve inherited that company—it’s a family business.
They may have five, they may have ten,
maybe they have 30 employees.
They’re at a point in the scenario
where they’re considering the loss of all of that,
and it can be very emotional.
A wave of cybercrime is hitting US hospitals.
Security experts warn hundreds more are under threat.
Here in the UK, hospitals have been badly hit,
including this one in central London.
The hospital told Ken Robbins his cancer surgery was delayed.
They don’t realize what impact they’re having on patients.
You’re talking about a healthcare organization
where people’s lives are literally at stake,
and they don’t seem to care.
It can be very, very frustrating.
Our job is to remain calm
and be the objective voice of reason in these cases.
Unfortunately, the bad guys we’re dealing with
have no negative consequences for their actions, no accountability.
If they had some moral compass or some well wishes for the victims,
they wouldn't be doing this at all.
With the advent of both the dark web
and the proliferation of cryptocurrency,
we now have an anonymous way to perpetrate attacks
and do the negotiations in an anonymous way
to transfer large sums of money internationally undetected.
Virtually every cybercriminal
demands payment in cryptocurrencies like Bitcoin
because a crucial feature of these currencies
is that they are largely untraceable.
The best thing that we can do as a country and as organizations
is to defend ourselves.
Many of the tools that threat actors are using to attack these businesses
are common tools, are not sophisticated,
and this is avoidable.
If we want to dissuade the threat actors
from doing these attacks,
we can just make them harder to do.