All About Ransomware

How ransomware works, from the anatomy of a hack to how the groups operate; the role of nation-states, insurers, and regulators; and what to do if your stuff is taken hostage...

• 0:00Speaker 00

  Hi and welcome to the A16Z Podcast. I'm Das. Today's episode is all about ransomware. We've covered a lot of different types of organized cybercrime and hacks on our show over the years, many of which you can find at A16Z.com/hacked. But in just the last couple of years, ransomware in particular, has grown into a multi-billion dollar industry. It's evolved from taking systems and servers hostage to stealing data, and it's capable of shutting down global organizations. In recent months, ransomware groups directly shut down Kia Motors' North American IT systems, indirectly led to the death of a patient due to hospital ransomware, and allegedly stole sensitive files from a law firm whose clients include former President Trump.

• 0:43Speaker 00

  So in this quick explainer episode, Tom Hoffman, the SVP of Intelligence at Flashpoint Intel, which monitors ransomware criminal syndicates and assists organizations with prevention and response, shares his expertise with us. Along with A16Z's security operating partner, Joel Delagarza, we cover how ransomware works, from the anatomy of a hack to how the groups operate, the role of nation-states, insurers, and regulators, and what to do if your stuff is taken hostage. But we start with Joel explaining, what exactly is ransomware?

• 1:15Speaker 01

  Ransomware is kind of the pinnacle of the crime ware/hacking-for-profit-type-activities that we see. It is basically software that's used to take your computers or your data hostage and hold them for ransom until you pay the hostage taker money to release them. It isn't sophisticated espionage led by a nation-state. This is very much about, how do you, at scale, get enough victims and have enough of an infrastructure to successfully monetize the hacking that you're doing? It is literally the fastest-growing area of cybersecurity. Like, ransomware is just proliferating at such an insane rate.

• 1:55Speaker 00

  Why are we hearing so much about ransomware right now? Like, what's kind of led to its rise?

• 2:01Speaker 01

  So there's a couple of factors that have come into play. The first is, all businesses are essentially, you know, tech, data, computer businesses. And so when you start to be able to take those kinds of information assets hostage, it gives you the leverage to demand money from them in order to release them.

• 2:18Speaker 02

  I think definitely in the last five years, the monies associated with this are a lot higher. A couple of years ago, the higher-end ransomers would be... Two hundred thousand dollars, occasionally you'd see it up to half a million dollars. Today, the starting point is probably two hundred thousand dollars. And we've seen up to forty and fifty million dollars ourselves. And we've heard from others that they've seen a couple that went up to the hundred million point as they keep getting bigger and bigger paydays. The next ransom is getting bigger and bigger. So this is one where the economics of this all, it's attracting more and more of these groups.

• 2:56Speaker 01

  And like, the amount of money that's being paid to ransom takers, the amount of money being paid to secure all this infrastructure, there's no silver bullet because it isn't an actual technical threat that we can build a product for. In reality, it's a business process and you could actually conduct a ransomware attack without using any software. You could guess the password to someone's server. You could log into that server and then decrypt the hard drive with a passphrase that only you know. And you did this with no software. You just connected through terminal services. You didn't need any malware or zero days or any of that. And so ransomware is kind of of less of a product and more of just a business model.

• 3:35Speaker 00

  In the landscape of different types of cyber attacks, where does ransomware fit in? You've got things like malware, you've got phishing.

• 3:43Speaker 01

  A lot of these guys started spamming like in the late nineties. Like their business was building these massive infrastructures to send out really annoying emails. And so as spam got cracked down on, they just repurposed that infrastructure. And so it became less untargeted spamming and became more focused on like phishing. And then as phishing stopped working, they pivoted towards like malware. And so they use the infrastructure to deliver bots and then they build botnets. And I think at a high level, that just describes the evolving process that we've seen with these global criminal organizations, which is that you build an infrastructure to accomplish a mission X so you can steal their banking credentials. Once that avenue shuts down, you still have an infrastructure, you still have a team that you've built. And so you want to find ways to further extract value.

• 4:26Speaker 01

  And now they're using a lot of the same infrastructure to either grab your account and go after you personally, or grab your local machine and encrypt all your data and then try to sell it back to you. Ransomware is one of the new heads of the many-headed Hydra of this organization.

• 4:40Speaker 02

  Yeah, we monitor a lot of the Eastern European criminal communities. And what's interesting there is there are some of these modules where depending upon who the victim is. The botnet can automatically determine which module to drop, whether it's an information stealer, or it just lurks and goes and monitors and will check back in at a future date. And others identify if it's a large company and write for the ransomware variant. They'll look at your latest filings. They'll see how much money you have in your bank accounts. We've seen one where they knew what the insurance policy, what they're insured up to. So part of the negotiation was, hey, we know you're insured up to $20 million.

• 5:25Speaker 02

  Just get your insurance company to pay this. There's a lot of companies have really advanced anti-fraud detection techniques. It's really made it harder to monetize a lot of these infections. That being said, when we look at all those same infections, they figured out kind of where they can bypass a lot of these fraud protections, which is you take a actually relatively simple technology, which is encryption, and they lock up your systems.

• 5:52Speaker 00

  Walk me through kind of the anatomy of a typical attack today. What happens when somebody takes something hostage?

• 5:59Speaker 02

  So how they gain that initial foothold? It's actually very basic. They scan the internet for these vulnerabilities, these open exposed ports. A lot of the infections we see are from remote desktop protocol. So RDP, where these RDP connections will be brute forced by a bot until they gain access. We've seen the use of phishing emails. They will deliver some piece of malware. And what they're exploiting, it's typically vulnerabilities from 2018, 2019. So all things that have existing patches. Once they gain that initial foothold into someone's network, they are increasingly using tools like Cobalt Strike.

• 6:43Speaker 02

  This is a legitimate pen testing application. There are cracked versions of that that are available within some of these criminal communities. The Cobalt Strike is quite often used to really move laterally across networks, to deploy additional beacons, to deploy additional payloads. A lot of organizations, you're most worried about getting those patches deployed on anything that's externally exposed, anything internal. You kind of push to the back burner because how would anyone ever be able to exploit that? But it's those internal systems that the patches have not been deployed that enable. Take over a lot of key accounts. They're trying to get to the domain controllers. And then, once they have access, they'll try to remove backups.

• 7:26Speaker 02

  They'll disable your, any endpoint security solutions you might have. And once they have your network at that point, it's typically ready to be encrypted from initial infection to full network encryption. Could be as soon as five or six hours.

• 7:43Speaker 00

  Is it just computers that are being taken hostage? Is it the data? Is it a mix of both? Does it vary by attack? Like, what is actually being taken hostage?

• 7:52Speaker 01

  Yeah, so there's definitely been kind of an evolution in the way that ransomware has taken things hostage. And in the, in the, in the old days, you know, two years ago, it would focus on taking hostage sort of hardware assets. And this could be routers. It could be Wi-Fi access points. It could be laptops or servers. And basically getting in there, changing the password to something you don't know, and then trying to sell the password back to you so that you can get back into your equipment. With attacks like that, people generally have backups. It's easy to recover. You just reinstall the operating systems. And people would just recover instead of paying the money. As it's evolved, they started to actually target encrypting hard drives. And as defenses kind of got better and people started to understand how that attack worked and finding ways to either recover and reboot,

• 8:36Speaker 01

  they actually started going after data.

• 8:38Speaker 00

  So how does that work? You know, they get in and a hacker is encrypting your data. What exactly is happening on the technical level?

• 8:48Speaker 01

  Yeah, so, so for the purposes of simplification, there are ultimately kind of two sorts of encryption. One of them is symmetric key encryption, and the other one is an asymmetric key encryption. So in the one instance, there is one key, and you use this one key to encrypt everything. So I generate, let's say, a number. Let's, the number is 32. And I encrypt all of your data with the number 32. And then, at some point in the future, I, I sell you this number to decrypt your data. Now, the issue with that kind of a system is that I'm sending this key to you to encrypt it as well as to decrypt it. So if you can intercept this key, you can then just undo what the ransomware author has done.

• 9:31Speaker 01

  So what they've tended to do now is asymmetric or public key encryption, where they'll send you a public key. To encrypt your data. And there's no way, even if you intercept that public key, that you could decrypt that data. You actually have to get a private key that gives you the ability to decrypt it. And the attackers hold on to those private keys and they sell them to you for, you know, hundreds of thousands to millions of dollars.

• 9:53Speaker 00

  So with that asymmetrical key, why can't you crack the code and just decrypt it back?

• 9:58Speaker 01

  They're using industrial-grade encryption, which means that it would take, you know, all of the computers on the earth 35,000 years to decrypt it if you don't have the key. It's just the game of making recovery of the data more expensive than just paying the ransom. And that's, that's ultimately like, it's kind of weird to say, but that's how the market finds its price. If you destroy all of these laptops and it's going to cost you $70,000 to replace them, and they're asking for a $500,000 ransom, you probably just pay the $70,000 to replace the hardware. Right? And that's, that's kind of price discovery in a, in an illicit market.

• 10:35Speaker 00

  The thing that's maybe most striking to me in this conversation is that these ransomware, you know, literally Evil Corp, Evil Corporation is functioning much the same way as legitimate businesses. So what are their different departments, different functions, different specializations that are really critical to how they operate?

• 10:55Speaker 02

  A lot of the botnets that are operating, they are really some of the more commodity malware, the dropper malware. But with a lot of these criminal syndicates, they really are bringing in additional expertise, technical understanding, how to run these botnets, how to deploy new modules so they can better prioritize where they want to target these ransomware deployments. And I think Evil Corp's a good example. What really brought them into prominence was they were running the global botnet, Drydex. How they developed that botnet really brought in expertise from how do you do the reconnaissance for who your victim list is going to be?

• 11:36Speaker 02

  As it was spamming, you had to have a, someone operating the spam botnet and how that was going to bypass all of the email filtering software. Then you needed the actual module you were going to deploy. So you had different parts of the organization that were really focused in on that payload. And once you got the payload on to someone's systems, well, you needed to maintain the command and control infrastructure where this was going to call back to. Then how the malware would insert itself in the middle of your session with your bank. Once you had that information, then you had to figure out how you were going to use that. Well, you had a different part of your group that was the information reselling network. So it really is every part of that cyber kill chain that these groups, some

• 12:20Speaker 02

  of those were part of the larger syndicate, other ones were just brought in as needed, where it was a specific exploit.

• 12:27Speaker 00

  Is there like an in-house operation? Or is this kind of different functions of an assembly line and each one's kind of its own organization? It's kind of that age-old tech question of, you know, how much of this is vertically integrated and how much of this is different slices of the infrastructure stack?

• 12:44Speaker 02

  There's a lot of online communities where a lot of these individuals come together. There are specific forums in how you develop exploits. There's other forums that you can go and learn the latest in cryptocurrency and the different fraud schemes that are associated with that. So we've seen that there are a lot of opportunities for individuals who want to get involved in this type of activity. You really start at the lower end and you develop some relationships and over time you start doing more advanced operations. And as you start getting money, you can go to these same forums and you can solicit for additional support. And over time, we've seen, especially in the Eastern European

• 13:27Speaker 02

  space, there are individuals who have been there for decades. They moderate content on these forums and these communities. And we've seen that with that trust and that reputation online, when you want to do some operation, you'll get the best of the best to come together. So to know can be, they put out the call for papers. They had, I think, 40 to 50 technical papers submitted. They chose the top three who got cash rewards for the first, second, and third prize. And then they were invited in to join the syndicate, which could earn you up to $60,000 a month. If you're running your own ransomware scheme, you can rent out the ransomware as

• 14:12Speaker 02

  a service, you can rent out the infrastructure, you can rent out negotiating services, you can rent out all pieces of this and you get to keep 80% of your illicit proceeds and then you give 20% back to the larger collective and they use that to reinvest in the technologies that allow them to go continue to innovate and deploy these malicious campaigns. And it's just a, what's the opposite of a virtuous cycle? That's where we are right now.

• 14:41Speaker 00

  You started answering the next question I had, which is who is at the top and who are these kind of ransomware founders? Do we know who they are? Are they mysterious figures or are they kind of out in the open?

• 14:53Speaker 02

  There's a couple out in the open. The one, Maxim Yakubets, there's photos of his Lamborghinis and his wild party lifestyle. What's also interesting with that is I believe his father is a local mayor and his father-in-law is potentially FSB in Russia, the FBI equivalent. When the US government or someone else is able to identify the actual identities of some of these criminal actors, they typically are very closely connected to those in powers, which I don't think we've had a smoking gun yet, but there's one degree of separation, which really leads to a lot of questions about what role does the state have in this?

• 15:36Speaker 01

  I think for me, one of the most shocking things I sat through was the Secret Service briefing on cybercriminal gangs and how one of the leaders of one of these large organizations is actually a member of the parliament of a national government and is a bit of a folk hero in his home country.

• 15:52Speaker 00

  What determines the role or the incentives of a nation-state?

• 15:55Speaker 02

  The nations who have really strict controls on access to the internet, we see over in China with real name verification. It actually makes it quite hard to be anonymous on the internet, make it hard for criminal groups to operate within cyberspace. And on the flip side of this, you see in Eastern Europe, in particular Russia, where there is not really a effort to de-anonymize the users. It's almost an implicit understanding that if you don't attack former Soviet bloc countries, that you'll be left alone. So it has allowed these groups really to feel emboldened to conduct some of these attacks, where they don't really feel that the long arm of the law is ever going to reach out to them.

• 16:40Speaker 01

  And I think that's a really important point that underlines why this is such a difficult problem. There are a lot of countries where you don't have the same divisions between criminal police and military. And so you'll have someone who works for, let's say, a government agency during the day and then freelances for some organized criminal syndicate at night. I think one of the big differences is that we generally have treaties with a lot of countries that we will respect their system of justice and policing and execute on valid warrants. They typically call these MLATs, Mutual Law Enforcement Assistance Treaties. And we have these with a lot of our allies. So that in the event that you had some super criminal working out of the UK, we could coordinate with law enforcement there, have that criminal arrested and brought to jail. With adversarial countries,

• 17:25Speaker 01

  there's no such agreement, there's no such treaty. It's actually very difficult to work with law enforcement in these countries and bring them to justice. And it's also really difficult when the activities of the folks who are committing these crimes in these countries align to their national interest, which is to antagonize Western governments. And so as long as there isn't a framework for enforcement or a framework for criminal justice, then you're just basically creating these incubators where you have these really innovative, dynamic organizations at the cutting edge of committing crimes.

• 17:54Speaker 00

  So you've talked about the incentives of different nation-states. What role do cyber insurance regulators have to play in?

• 18:04Speaker 00

  Incentivizing or disincentivizing these attacks.

• 18:07Speaker 01

  You see in movies, there's always this statement that the US doesn't negotiate with terrorists. And the reason why is that it creates a really dangerous incentive structure for the bad guys to continue escalating their very negative behavior. And so cyber insurance is something that's been around since probably the mid 90s. And for 20 something years, it was the best business you could be in because you'd collect these premiums and never pay out. There were all these clauses in cyber policies that wouldn't let you pay out because every intrusion was different. They would cut out nation states, they would cut out cybercrime, they would cut out all sorts of things. Well, lo and behold, they started writing policies that they had to pay out on. And these were the ransomware policies.

• 18:48Speaker 01

  I'm pretty sure initially the calculus for these insurance companies was that they're making so much money that it was just cheaper to pay the ransoms, right? And it was cheaper than fighting them in court and cheaper than trying to pay for recovery. And the criminal actors figured this out and they've built a very sophisticated business as a way to extract these payments from these insurance companies. And now you're looking at probably the first year where a lot of the leading cyber insurers are going to lose significant revenue. They're going to have to increase premiums. As a basis, I think next year you'll see premiums going up 40 or 50% across the board. And if you're a company that's paid out a ransom, you're probably going to see your premiums triple or go up by a factor of 5X.

• 19:29Speaker 02

  I would also add on to that. We're seeing that as companies are renewing their policies, they're ensuring that there is coverage for these types of events. So the actual number of insured companies is, I would have to double check, but I think the last I saw was maybe 30% of companies have a cyber insurance policy. And over the next 10 years, that's expected to go 60 to 70% of.

• 19:53Speaker 01

  I think cyber insurance, the insurers have found a way to build sort of the perfect storm, right? The lack of criminal prosecution in these countries is one thing, but the combination of zero consequences, zero costs, combined with outsized financial returns, earning millions and millions of dollars, you're essentially incentivizing kind of the best and brightest with. Outsize financial payments, very little risk of any kind of criminal prosecution. And so you've built this system where you're just going to continue to have these problems, this escalation.

• 20:24Speaker 00

  I want to transition into talking a little bit about the regulators because it seems like that's really related here. So what's been the impact of regulators and of regulation?

• 20:33Speaker 01

  I think the big impact that we've seen in the last couple of months was that the US Treasury Department issued some advice that paying some of these ransoms to people that were on the OFAC list could get you into some serious trouble.

• 20:45Speaker 00

  Could you clarify real quick what OFAC is?

• 20:47Speaker 01

  Yeah, so the US government maintains this list of terrorists and dictators that commit genocide, literally just the worst of the worst. And so if you do business with those folks, if you conduct any kind of financial activity or transactions with them, you're subject to criminal penalties under US law. And so the US Treasury issued a directive earlier this year that paying ransom out to anyone who's on an OFAC list could potentially subject you to criminal liability. And then they turned around and added Evil Corp, or one of the big Russian crime syndicates, to the list. So at this point, you've kind of set up people in the US who made plans to essentially pay out these attackers, that they're going to get themselves into a situation where they've

• 21:30Speaker 01

  been breached by an organization that's on the OFAC list. They're going to pay them a ransom, but they can't because then their executive management will face criminal liability.

• 21:39Speaker 00

  Tom, how are you seeing that play out with the different executives and companies that you're working with?

• 21:44Speaker 02

  Yeah, this actually dominates a lot of our conversations, especially when we're dealing with victims. And once a company gets to the point where they're contemplating a payment, it's a lot of questions around how do we know if someone's on the OFAC list? How do we know that even if they aren't on the OFAC list now, that I won't be held liable if they get added in six months? And the answer to all this is, you don't know. You check the OFAC list through the Treasury, the EU, the UN, there's a lot of different lists that you can check. The reality is, every week, there's a new group, some groups that will call themselves a new name next week. So now the attribution of who's really behind it, you don't know.

• 22:26Speaker 02

  As Joel said, there's really only one group who made it on the OFAC list, and that's the Driedex and the Evil Corp. So now people are afraid about paying into that group.

• 22:38Speaker 02

  But it's still unclear because you don't actually know who's on the other end of that that payment. We always encourage victims to talk to law enforcement. I'll say the FBI has been fantastic hopping on phone calls with with different victims, walking them through what others have experienced, what they've seen, what they do know. So while they will never give a green light to go make these payments, we have seen that talking with law enforcement helps the victims really better understand really the legal environment in which they're operating.

• 23:09Speaker 00

  So I want to make sure we get into some of the prevention and response. So you know, you you talked a little bit about how ransomware is finding its way into organizations and that it's sometimes it's really basic stuff. It's a phishing email. It's an unpatched system. Given the vulnerabilities that they're exploiting, what are the things that organizations can do to prevent attacks?

• 23:27Speaker 01

  These guys are using low effort, low technical sophistication, operations at scale to then try to monetize and and find a way to make money. From an attack and penetration perspective, a lot of these organizations are really just sort of using bottom feeding tactics. They're going for things that are easy to fix, and the reason for that is quite simple, and it's economic. If they had a sophisticated attack, a zero day exploit, or some really clever way to gain access to information, they wouldn't use it for ransomware. They would actually probably sell it for millions of dollars to some sophisticated actor who would then weaponize it against a a high value target. That's really where just doing basic hygiene, I hate to shamelessly self promote, but we

• 24:10Speaker 01

  wrote a really great blog piece on this, about 16 things you could do to protect yourself. I think if you just follow the first five on that list, you probably keep yourself out of trouble with ransomware. It is really just as simple as using 2FA, patching your systems, and just doing good IT hygiene. Like, it's it's not rocket science. It's not cool. It's not sexy. It's like brushing your teeth.

• 24:30Speaker 02

  Yeah, and to add on to that. Password managers, you have to make it easy for employees to do the right things. And if it's expecting an individual to remember 20 different passwords to 20 different sites, it's just unrealistic. And I know from our perspective, we see stolen credentials coming through the different malware C2s that we monitor every day. We see the different databases being sold every day. We see the different combo lists that are uploaded to various sharing sites every day. Just in the past month, we've seen 100 million new credentials. This is where like the thinking that a password is going to keep you safe, that's not realistic.

• 25:11Speaker 00

  I want to move over to response. Someone has been hacked. How do they assess what their options are?

• 25:17Speaker 02

  When someone finds themselves a victim of ransomware, what we always say is ask for help first. Do not try to do this on your own. We've seen too many times where a proactive IT specialist thinks they'll handle it quickly, that has come back to just exacerbate the problem and make it even worse. The first thing that happens is they say, we have backups. We'll be back up and running 24 hours. And then several hours later, they come back and they say, oh, actually our backups aren't, they haven't actually been backed up in a long time. Then at that point, it's wait, what do we do? And it's like, well, we're going to try to recover. And this typically just erodes confidence

• 25:58Speaker 02

  as it goes further and further. Once that encryption is there, I hate to say it, if you don't have good backups and you don't have those offline, the chances of recovery are pretty slim. Once you're at that point, it's really the discussion of how valuable is that data? Some companies we've worked with, the data really wasn't all that valuable. And they're like, yeah, we'll just rebuild the systems. Other companies, one was engaged with some DNA research and they needed to get the data back, but they were very interested in how the decryption process would work because they needed to have absolute confidence that bit for bit, the decryption process was not going to corrupt any of their data.

• 26:38Speaker 02

  And unfortunately, we couldn't give them any assurances because how that encryption process proceeds, it depends kind of what state that database was in at the time when it was encrypted. And nowadays, there's a lot of information being stolen as well. So the ransomware variants are threatening to post stolen information, which includes customer details. It sometimes includes medical information. So this is also a complicating factor where some companies, they might be able to recover from offline backups, but really what they're worried about is protecting their customers, protecting health information that they don't want to have exposed. For every situation, it really depends on what the victim is trying to achieve.

• 27:22Speaker 00

  Once you have somebody and they've kind of decided on their response and you're getting them in touch with the other side and starting a negotiation, what does that negotiation look like? How does that normally proceed?

• 27:32Speaker 02

  Yeah, we've seen it typically proceeds down two paths. Sometimes you'll be given an email that you're to reach out to. It's typically a Protonmail email and you'll ask what the ransom demand is and they'll give you typically in Bitcoin what they expect to be paid. And from there, we will go back and forth and really try to get it down as much as possible, but depending upon how much the victim has revealed and how fast they want to move through the process will really dictate kind of how that plays out. The other thing that we're seeing more often is a victim in the ransom note is given a site that they will go access typically on the Tor network, the dark web, and you'll

• 28:17Speaker 02

  typically have to put in an alphanumeric code that will allow you to get to the specific site that they have set up. So you'll see on the portal, they'll have your ransom demand, how much you need to pay, when you need to pay it by, and typically that will start a timer. And once it hits zero, they tell you that the ransom will double. So this really is just a complicating factor, especially when. Victims are trying to figure out, can they pay? Do they have an insurance policy? If so, who do they need to notify? If you're going to be spending millions of dollars, typically you need to go up to get board member approval to do that. So the criminal groups do that for a reason. It's to ratchet up the pressure.

• 29:00Speaker 02

  Another reason why we say, do not reach out to that criminal syndicate by yourself either, because sometimes just by the simple fact of logging into that page, and that might be the first time they actually know they successfully deployed it and you couldn't back up.

• 29:13Speaker 00

  You know, I'm thinking kind of the analog equivalent of these attacks where somebody has somebody hostage and that moment of payment and return is such like a high suspense, kind of high stakes moment. How does that work with a ransomware attack? Like, how do you know, hey, I've just sent you money. I'm actually going to get back what you said, especially because we've pretty much established there's not a lot of scruples on the other side.

• 29:37Speaker 02

  Yeah, it's throughout the entire negotiating process, these groups, especially the more established ones, they will point back to the press headlines and say, hey, we're a legitimate business. It's in, it's in our best interest to actually deliver the keys and make it work or else no one in the future will ever pay us. For some of the groups that we were talking about, sometimes it's automated where, once you log into the portal where they're managing your specific victim case, once the cryptocurrency, once it's submitted into the specific wallet that they've designated, it just automatically releases decryption keys within the portal. And then we have others where you're going through email and typically they'll get back to you in about four hours and, and sometimes they'll ask you for the specific alphanumeric

• 30:22Speaker 02

  codes for the different encryption variants that are on your network. And they, they will give you specific decryption keys that will work for each one of those. But we tell victims all the time, you're dealing with criminal actors, there's a risk and, and we've seen it. Even recently, where you make a payment and the actor is just a say, nope, now the ransom is double. Pay me more. Thankfully, that's the exception than the norm.

• 30:47Speaker 01

  I was just gonna say, I don't know if it was, I don't know if it was a joke or if it was actually happening, but I had heard that there was a ransomware crew that was hyping its NPS score. So it's net promoter score, saying that it had done such a great job at getting people returned to functioning service, that that's why you should actually trust them. So I think they are concerned about their reputation and do want to make their victims whole again.

• 31:08Speaker 00

  We were on kind of the moment of payment and return, and I'd love for you to then talk a little bit more about, once the data's been decrypted, how does that disaster post-recovery work? And, you know, what do organizations do to come out of this?

• 31:24Speaker 02

  Once you get the decryption keys, depending upon how large your network is, it's at least a week, probably closer to four weeks, until you really get all your systems back. You prioritize what systems you want to bring back first. So, so all the critical systems come back online. You can typically get those back functional within a few days and then bring everything else up. Before even starting the decryption process, it's needing to understand how did that initial infection occur and figure out exactly where it is. So you eradicate that before you bring the systems back up. Ransomware groups will say that they won't revictimize the same victim twice, because

• 32:06Speaker 02

  that's not good for business either. But what we've seen is the, there's a lot of groups that are going after these same vulnerabilities that are running the same system. So it might not be the same group, but it might be a separate group that tries to come in the same way.

• 32:19Speaker 00

  Ransomware's been in the news a lot lately, largely because of the increased attacks on these critical infrastructure, most notably hospitals. You know, I think it was like October 2020, where you had like the first death attributed to ransomware with a German hospital that was, was attacked. And then as a result, I think a patient died because they couldn't receive treatment. How is that changing the response or calculus?

• 32:42Speaker 02

  That conversation is, as it pertains to the healthcare, has actually been around for a couple of years now. Back in 2016, within one of the Russian illicit communities, they were actually debating the ethics of using ransomware against hospitals. And it was really split right down the middle, where half the participants were saying, yeah, that's a bridge too far. We should only use ransomware to go after companies who have money, but once it goes into impacting or someone's life is at stake, that's too far. Then the other half were saying, eh, it's money, we're gonna do it. And I think what we've seen over the last couple of years, some of these groups will

• 33:24Speaker 02

  pay lip service into not going after hospitals or critical infrastructure, but the reality is they're all doing it.

• 33:32Speaker 01

  Yeah, I mean, the thing that's particularly concerning is that these guys are going after parts of our critical infrastructure at a time when we're particularly vulnerable. So the targeting of hospitals right now is particularly worrisome. I think that's a clear national security threat, right? Not just to the financial prosperity of our country, but also this is a genuine risk to the lives and well-being of our citizens.

• 33:56Speaker 00

  When it's been lives at stake rather than just wallets, does that change how you advise or work with somebody who's been a victim of ransomware?

• 34:03Speaker 02

  From the responder's standpoint, it makes it more personal. Unfortunately, at the end of the day, it's a business transaction. The other side, they just want to get paid, and we try to get them there as quickly as possible.

• 34:16Speaker 00

  We've seen ransomware in kind of over the course of this conversation. It's evolved organizationally. There's obviously been technological advances. Where do you see ransomware going from here? How's this field evolving and what's coming next?

• 34:28Speaker 02

  Where it evolves from here? It only gets more dangerous, I think. Everything is digitized. And I think what is scary as we look forward, these groups are also understanding that right now, it seems like they're very much just posting the information and they don't really know what's in there. What comes next? I think it's going to be using that information to identify individuals. And I think that's going to be one, which is going to be much more personal to all of us as companies who we do business with. Once that information's stolen from them and once these actors have that, like what can they do to the individual and to the customers and employees to really extend

• 35:10Speaker 02

  this criminal enterprise to your home and your family? Doing the basic hygiene to protect ourselves from these attacks? That's good, but as we've seen, they'll come back with something else. And if this revenue stream dries up, it's not that they're going to go away. They're just going to come back in a different form. So I think that's why it's going to, the way out is going to be part of this public-private partnership. It's how we work with international law enforcement, how kind of these norms around cybersecurity are really codified and need to be embraced. Well, thank you very, very much. Take care. Thank you. Take care.