The Streisand Effect May Apply

Paying off ransomware hackers to avoid notoriety is a losing proposition, finds a study of LockBit victims that identified a correlation between unwanted attention and succumbing to extortionists, as opposed to standing firm.

See Also: How Generative AI Enables Solo Cybercriminals

“It seems that paying the ransom doesn’t at all appear to reduce public exposure – if anything, it increases it,” Max Smeets, co-director of Virtual Routes – formerly known as the European Cyber Conflict Research Initiative – said in a keynote presentation at the Black Hat Europe conference in London. Smeets holds research positions at ETH Zurich and Stanford University.

Smeets reviewed data gathered by Britain’s National Crime Agency, which led an effort to disrupt LockBit, codenamed Operation Cronos, that in 2024 featured authorities seizing dozens of the group’s servers (see: Arrests and Indictments in LockBit Crackdown).

The crime agency gave Smeets access to data to study it for further potential findings, with a caveat that he protect victims’ identities and not provide any advantage to adversaries. Smeets said he started by looking at the largest 100 payouts to LockBit, compared to a sample of 100 random cases in which a victim refused to pay.

He found that paying the ransom generally doesn’t hide the fact that an organization fell victim to hackers, despite the explicit deal offered by ransomware hackers of keeping victim identities secret – so long as they pay.

Instead, Smeets found that victims who paid a ransom are covered more by local media, national and international media – especially in cybersecurity press coverage – than organizations that didn’t pay.

Of the 100 victim organizations that paid, cybersecurity press coverage detailed nearly 40 of those attacks, compared to only about 28 of the attacks or breaches involving victims who refused to pay being reported by those outlets.

Smeets said he suspects that attempting to suppress information about a ransomware payment triggers a version of the Streisand Effect. The term was coined after singer Barbra Streisand in 2005 attempted to suppress a photograph showing her clifftop villa in California, which instead intensified online focus on it.

In the case of ransomware, two ways this effect might get triggered is when “the payment itself becomes the story, not the breach,” as well as because “paying also signals a loss of control,” meaning it that “if you pay, it seems to suggest things weren’t in order,” potentially pointing to a cover-up, whether or not that is what happened.

This isn’t the first time the Streisand Effect has been witnessed in the cybersecurity realm, not least when organizations attempt to suppress research that details potentially embarrassing cybersecurity shortcomings (see: Burger King Uses Copyright Law to Nix Security Research).

The Long Decline of a Former Star

Smeets said the data seized by the NCA that he’s analyzed paints a stark picture of LockBit’s decline.

During the group’s heyday from May 2022 through February 2024, data shows the group splitting extortion money with 80 affiliates, of the 110 who entered into negotiations with victims. All told, 148 affiliates downloaded at last one ransomware build from the operation and 194 affiliates signed up in total, although some might be different personas used by same individual. Of the group’s 610 victims in this timeframe, 8.5% paid a ransom to LockBit.

From December 2024 through April of this year, Smeets said that out of 75 affiliates, only eight ever appeared to have gotten paid, with many of those payments appearing to go to just one particularly active affiliate. Smeets estimated just 19 victims paid LockBit extortion money during that period.

The NCA’s infiltration of LockBit retrieved every piece of data the group ever stole, meaning that even when a victim paid for a promise that its stolen data would be deleted from LockBit’s servers, the group deleted nothing.

The NCA also outed the group’s leader, Russian national Dmitry Yuryevich Khoroshev, aka “LockBitSupp,” and used LockBit’s own leak site to troll both its leadership and affiliates in an attempt to break criminal trust in the group. Smeets said these tactics have had a demonstrative “cognitive effect” on LockBit’s operations, truly helping to disrupt the group (see: Europol Details Pursuit of LockBit Ransomware Affiliates).

While Khoroshev remains at large, presumably in Russia, and continues to claim that LockBit remains a going concern, multiple cybersecurity experts say that despite his bluster, that is no longer the case, as evidence on multiple fronts, including the group’s failure to innovate its crypto-locking malware, as well as affiliates flocking to rivals.