Cybercrime
,
Fraud Management & Cybercrime
What’s Left After Raking In Millions From Other People’s Blood, Sweat and Tears?
Things that continue to elude scientific observation: the Loch Ness Monster, Bigfoot and the ransomware hacker who voluntarily chose retirement.
See Also: Fighting Deepfakes: Transformative Approaches to Protect Your Business
Some ransomware hackers have dangled promises to leave the field. Two weeks ago, a post to cybercrime site BreachForums by “Scattered Lapsus$ Hunters” claimed that members of the combined cybercrime community spinoffs Scattered Spider and ShinyHunters would be “going dark” and seizing the opportunity to “enjoy our golden parachutes with the millions the group accumulated.”
The Western adolescents who comprise Scattered Lapsus$ Hunters and excel at social engineering have been tied to a spate of high-profile breaches involving casinos and Salesforce customers, airlines and banks, as well as to the recent disruption of luxury British carmaker Jaguar Land Rover’s operations.
Seeing the extortionists retire might sound promising, but the message clarified that only “the most stupid” members would be exiting and that “others will keep on studying and improving systems you use in your daily life” and “in silence.” These promised “improvements” come from the same type of people who characterize their disruption of critical infrastructure, including hospitals, as “pentesting” – as if it’s a public service.
The first sign that Scattered-whatever’s retirement note was a confabulist creative writing exercise arrived just days after their missive, when threat intelligence firm ReliaQuest reported seeing brand-new signs of Scattered Spider targeting the financial services sector.
Clearly, the lying cheats who comprise yet another ransomware-wielding collective aren’t going anywhere.
“There’s no such thing as ‘retirement’ in cybercrime – what we’re seeing is classic operational security theater,” said Roei Sherman, senior director of research at threat research firm Mitiga Labs. “These groups announcing their supposed golden parachutes are likely trying to create distance from recent law enforcement pressure and buy time to rebrand under new identities. It’s a predictable cycle: when heat increases, they announce shutdowns, let things cool off, then resurface with different names and slightly modified tactics.”
“Money is often the biggest driver, but it’s not the only one,” said John Fokker, head of threat intelligence at Trellix, who previously worked at the Dutch National High-Tech Crime Unit. “Cybercrime offers fast wealth and a taste of luxury that can be addictive. Add in ego, status, the thrill of outsmarting others, or childhood trauma and it becomes clear why walking away is rarely easy.”
Even when the writing is on the wall, ransomware practitioners have a tough time stepping back. Florida resident Noah Urban, 20, sentenced last month to serve 10 years in prison for his role in Scattered Spider attacks, told Bloomberg he continued to hack even after the FBI seized multiple devices from his home.
“It’s more than addiction, it’s their life,” Gregory Kehoe, U.S. attorney for the Middle District of Florida, told Bloomberg. “If your entire socialization network is wrapped up with these online communications on numerous platforms, what is the likelihood that, even if you have a little bump in the road, that you’re not gonna drift back to that?”