bk99.de entertain the web since 1997

bk99.de
KrebsOnSecurity · RansomwareCurated

BlackCat: Ransom does not buy trust

Summary

Using the Change Healthcare case, Brian Krebs shows how a presumed multi-million payment, a cheated partner and remaining data undermine every promise of deletion. An attributed address received around 22 million dollars on 1 March. An affiliate continued to claim it held four terabytes of stolen data.

Ideas

  • Ransomware as a service separates platform operators from the actual intruders.
  • Affiliates usually receive a large share of successful extortion payments.
  • Internal fraud can make stolen data a danger again despite payment.
  • A copied seizure notice can disguise an exit scam.
  • Decryption and claimed data deletion are two separate promises.
  • Central healthcare service providers turn IT outages into nationwide supply problems.

Insights

  • Criminal service models suffer from the same trust problems they exploit.
  • Ransom shifts risk but can control neither copies nor later demands.
  • Concentration increases efficiency and at the same time the social damage of an outage.

Quotes

  • You cannot trust criminals; their word is worth nothing. – Dmitry Smilyanets

Habits

  • Krebs cross-checks blockchain transactions, underground posts and statements by researchers.

Facts

  • Change Healthcare did not confirm the claimed payment at the time of publication.

References

Critique

  • Payment, data volume and internal dispute were not independently confirmed at the time of publication.
  • Blockchain movements prove a transfer of money, but on their own neither sender nor purpose.

Remarks

  • The article already marks the uncertainty clearly in its title.
  • Later reports confirmed a considerably larger scale of the data breach.

Recommendations

  • Plan recovery and communication independently of possible ransom negotiations.
  • Continue to treat exfiltrated data as compromised after a payment.
  • Reduce central dependencies with tested manual emergency procedures.

Read the original article

Search the Web Archive

CCC · 2023

Recovering files encrypted by Black Basta

Tobias Mueller analyses the Black Basta encryptor and uses a faulty reuse of the keystream to recover files with a known-plaintext attack. Ransomware can undermine strong primitives itself through faulty use. Data recovery benefits from knowledge of file formats, reverse engineering and cryptography together.

KrebsOnSecurity · 2010

Stuxnet: The attack does not end at the Windows PC

Using early Stuxnet analyses, Brian Krebs shows how several Windows vulnerabilities, stolen signatures and PLC manipulation made a targeted attack on industrial plants possible. Stuxnet used at least four Windows vulnerabilities that were unknown at the time. Microsoft closed the printer sharing vulnerability with MS10-061.

KrebsOnSecurity · 2025

6.3 Tbit/s: What came after Mirai

Brian Krebs examines a short 6.3 Tbit/s attack and links it to Aisuru, compromised IoT devices and a publicly rented DDoS service. The attack reached more than 6.3 Tbit/s. Google measured around 585 million packets per second.