Ransomware | KC's Blog https://www.kjctech.net Tue, 24 Jan 2023 18:20:55 +0000 en-US hourly 1 https://i0.wp.com/www.kjctech.net/wp-content/uploads/2016/12/cropped-KC-Logo.png?fit=32%2C32&ssl=1 Ransomware | KC's Blog https://www.kjctech.net 32 32 24634607 Paid Ransom for Your Ransomware Attack? Do Not Run their Decryption Tool Blindly https://www.kjctech.net/paid-ransom-for-your-ransomware-attack-do-not-run-their-decryption-tool-blindly/?utm_source=rss&utm_medium=rss&utm_campaign=paid-ransom-for-your-ransomware-attack-do-not-run-their-decryption-tool-blindly https://www.kjctech.net/paid-ransom-for-your-ransomware-attack-do-not-run-their-decryption-tool-blindly/#respond Wed, 04 Aug 2021 21:44:59 +0000 https://www.kjctech.net/?p=4654 Why? Here is a piece of free advice from Fabian Wosar (@fwosar), CTO of Emisoft. Click the link to see the whole thread. Or read along here. Here is free advice for all the ransomware threat actors out there: Do not obfuscate your decryption tools. Contrary to what you think, victims who paid the ransom will not blindly run the […]

The post Paid Ransom for Your Ransomware Attack? Do Not Run their Decryption Tool Blindly first appeared on KC's Blog.]]> Why?

Here is a piece of free advice from Fabian Wosar (@fwosar), CTO of Emisoft.

Click the link to see the whole thread. Or read along here.

Here is free advice for all the ransomware threat actors out there: Do not obfuscate your decryption tools. Contrary to what you think, victims who paid the ransom will not blindly run the tool they got from you.

Most victims will hand the tool they got from you to their DFIR contractor or a company like us to ensure the utility is safe to use and free of backdoors. We even provide that particular service for free to victims.

Only after the decryptor has been cleared can it be used by the victim to recover their data. So even though most obfuscators are trivial to reverse, the usage of any obfuscation raises red flags and delays the vetting process.

The only reasons you may want to hide your code behind obfuscation are either you are ashamed of how bad your code is (which most of you should be, honestly), or you think it would compromise your ransomware's security.

However, the security of proper cryptography does not depend on its implementation being kept secret. Instead, it solely depends on the keys involved being kept secret.

You like to see your victims as your "clients" or your "customers". Unfortunately, obfuscating the decryptor tool is nothing short of bad "customer service". So just drop it.

Originally tweeted by Fabian Wosar (@fwosar) on August 4, 2021.

The post Paid Ransom for Your Ransomware Attack? Do Not Run their Decryption Tool Blindly first appeared on KC's Blog.]]> https://www.kjctech.net/paid-ransom-for-your-ransomware-attack-do-not-run-their-decryption-tool-blindly/feed/ 0 4654 How Ransomware Evolved https://www.kjctech.net/how-ransomware-evolved/?utm_source=rss&utm_medium=rss&utm_campaign=how-ransomware-evolved https://www.kjctech.net/how-ransomware-evolved/#respond Tue, 11 Jun 2019 22:48:24 +0000 https://www.kjctech.net/?p=4357 In a webnar that details how MegaCortex, the most recent Ransomware, attacks the network, the presenter from Sophos briefly introduced how Ransomware evolved over the years, way back from 1989 when an AIDS trojan was spread by 20K floppy disks via postal office to most recent years attacks including WannaCry in 2017 and MegaCortex in 2019. Guess how many type […]

The post How Ransomware Evolved first appeared on KC's Blog.]]> In a webnar that details how MegaCortex, the most recent Ransomware, attacks the network, the presenter from Sophos briefly introduced how Ransomware evolved over the years, way back from 1989 when an AIDS trojan was spread by 20K floppy disks via postal office to most recent years attacks including WannaCry in 2017 and MegaCortex in 2019.

Guess how many type of ransomware out there? Believe it or not, there are thousands, definitely not covered by the image below:

The post How Ransomware Evolved first appeared on KC's Blog.]]> https://www.kjctech.net/how-ransomware-evolved/feed/ 0 4357