International police arrest 16-year-old alleged leader of huge ransomware group

[Reality]

Teen suspected of running KillSec ransomware group as cops seize servers, arrest three​

https://www.theregister.com/cyber-c...up-as-cops-seize-servers-arrest-three/5300784

Police suspect a 16-year-old was the main operator of KillSec, a ransomware group linked to around 1,000 suspected attacks worldwide.​

​

Authorities secured at least 110 TB of data on KillSec's leak site against further unauthorized access. Investigators are examining seized devices and data to identify victims, attacks, and suspects, and trace the group's criminal proceeds.​

​

16-year-old allegedly led ransomware gang behind hundreds of attacks​

https://www.foxnews.com/tech/16-year-old-allegedly-led-ransomware-gang-hundreds-attacks

International police seized KillSec servers and 110 terabytes of stolen data after tracking a ransomware operation allegedly led by a teenager​

​

Investigators also uncovered another detail that caught my attention. Europol says members of KillSec used artificial intelligence to help build and maintain ransomware infrastructure and identify potential victims.​

 

[Runwildboys]

Going off the grid...now.

 

[gtb1943]

16 years old
we got a real life Lex Luthor in the making

 

[speedkilz88]

KillSec appears to have focused mainly on organizations rather than individual home computer users. Still, the methods behind the attacks offer lessons that apply to everyone. Europol says the group exploited software vulnerabilities and poorly secured access points. Those are the same types of weaknesses security experts have warned about for years.

 

[Reverend Conehead]

Throw the book at him. I used to work for a company that recovered computers that had been infected by ransomware. I've seen people in tears when ransomware had wiped our years of their work building a business. Fortunately, we were usually able to help people. This was before ransomware typically encrypted data. It would just trash Windows so that people couldn't run their computers, but the data was still there. So we would boot to a Linux DVD and then copy their data to a thumb drive. Then we had a tool that let us go in and fix Windows. If that didn't work, we could always format the hard drive and reinstall the OS from scratch. Today the ransomware criminals often encrypt their victim's data and then claim they'll decrypt it if the victim pays up. So people will use keygens to get a password that decrypts their files (hopefully).

But I've seen the damage done by ransomware. Even if this kid is only 16, I hope he sees the inside of a jail cell.

 

[gtb1943]

Throw the book at him. I used to work for a company that recovered computers that had been infected by ransomware. I've seen people in tears when ransomware had wiped our years of their work building a business. Fortunately, we were usually able to help people. This was before ransomware typically encrypted data. It would just trash Windows so that people couldn't run their computers, but the data was still there. So we would boot to a Linux DVD and then copy their data to a thumb drive. Then we had a tool that let us go in and fix Windows. If that didn't work, we could always format the hard drive and reinstall the OS from scratch. Today the ransomware criminals often encrypt their victim's data and then claim they'll decrypt it if the victim pays up. So people will use keygens to get a password that decrypts their files (hopefully).

But I've seen the damage done by ransomware. Even if this kid is only 16, I hope he sees the inside of a jail cell.

you have to be so careful anymore. Back up your work monthly on a USB stick and put it somewhere safe. That way you only will ever lose a month and not everything.

 

[Reverend Conehead]

you have to be so careful anymore. Back up your work monthly on a USB stick and put it somewhere safe. That way you only will ever lose a month and not everything.

Oh, yeah. We schooled people in that. On my own system, I have an external drive for backing everything up, then I have thumb drives where I make a second and a third backup copy. The customers we had didn't do anything like that. Most of them simply saved stuff to the hard drive and never backed anything up.

 

[Rockport]

Throw the book at him. I used to work for a company that recovered computers that had been infected by ransomware. I've seen people in tears when ransomware had wiped our years of their work building a business. Fortunately, we were usually able to help people. This was before ransomware typically encrypted data. It would just trash Windows so that people couldn't run their computers, but the data was still there. So we would boot to a Linux DVD and then copy their data to a thumb drive. Then we had a tool that let us go in and fix Windows. If that didn't work, we could always format the hard drive and reinstall the OS from scratch. Today the ransomware criminals often encrypt their victim's data and then claim they'll decrypt it if the victim pays up. So people will use keygens to get a password that decrypts their files (hopefully).

But I've seen the damage done by ransomware. Even if this kid is only 16, I hope he sees the inside of a jail cell.

Happened at the company I use to work for. It was a financial company so the FDIC came down hard. This was 3 years ago and they’re still implementing new security all the time. Company paid the ransom.

 

[Rockport]

you have to be so careful anymore. Back up your work monthly on a USB stick and put it somewhere safe. That way you only will ever lose a month and not everything.

They don’t normally go for individuals. It’s rare if at all. They go for bigger fish.

 

[Reverend Conehead]

Happened at the company I use to work for. It was a financial company so the FDIC came down hard. This was 3 years ago and they’re still implementing new security all the time. Company paid the ransom.

I cringe that they paid those criminals, but I understand why. This kind of crap is a major financial hit to companies, and they need their files back ASAP to stop the bleeding. Their files were probably encrypted. It's sad because a good specialist may have been able to create a keygen to decrypt the files without paying the crooks. The keygens are the same technology that's had the nefarious purpose of pirating software, but in the case of ransomware, it's used by the good guys. I don't blame them for paying the criminals, but I wish it had been possible to avoid doing so. Ransomware attacks keep happening because they're profitable.

 

[Reverend Conehead]

They don’t normally go for individuals. It’s rare if at all. They go for bigger fish.

A lot of the times, their systems are automated and they extort from whichever fish gets caught in their net. We helped more personal users than companies against this criminal enterprise.

 

[Rockport]

A lot of the times, their systems are automated and they extort from whichever fish gets caught in their net. We helped more personal users than companies against this criminal enterprise.

What kind of monetary value were they demanding from individuals?

 

[DFWJC]

Regardless of age, he needs to do some serious hard time.

These scammers have wrecked countless lives.

 

[Rockport]

A lot of the times, their systems are automated and they extort from whichever fish gets caught in their net. We helped more personal users than companies against this criminal enterprise.

I asked AI about this:

• According to the Verizon Data Breach Investigations Report, about 96% of ransomware victims (where organization size was known) were small or medium-sized businesses.

The general consensus was 90%+ were businesses/organizations and less than 10% were individuals.

 

[Reverend Conehead]

What kind of monetary value were they demanding from individuals?

It varied. Most of them tried to keep it affordable, probably so that the person would think it was easier to just pay them. Most of them were demanding anywhere from $49 to $300. That was most typical, but there were some demanding a lot more, but it was always in the hundreds. I think it was probably because most of these were snares set to rob anyone who clicked a certain link. It was often something that said something like, "Java needs to be installed to display this page." Then, when they clicked it, it would install ransomware instead of Java or whatever. For most people, it was easier to just pay it to get all their files back. Our fee for decontaminating the machine was $250 for decontamination only. Some people paid us to decontaminating it even though the ransom was less. It was because they didn't want to pay the criminals, and I agree with them. Plus, who knows if the crooks would actually keep their word?

If we needed to go in and rescue files, there was an additional charge for that, plus the price of the thumb drive to put them on. I never saw any ransomware targeted at companies or at a specific company, though that's a real thing that exists. If it were targeted at a company, I would expect the ransom demand to be much higher. All the ones I saw were clearly "catch anyone you can" ones. This was also a while ago. It was from about 2008 to 2011.

 

[YosemiteSam]

Teen suspected of running KillSec ransomware group as cops seize servers, arrest three​

https://www.theregister.com/cyber-c...up-as-cops-seize-servers-arrest-three/5300784

Police suspect a 16-year-old was the main operator of KillSec, a ransomware group linked to around 1,000 suspected attacks worldwide.​

​

Authorities secured at least 110 TB of data on KillSec's leak site against further unauthorized access. Investigators are examining seized devices and data to identify victims, attacks, and suspects, and trace the group's criminal proceeds.​

​

16-year-old allegedly led ransomware gang behind hundreds of attacks​

https://www.foxnews.com/tech/16-year-old-allegedly-led-ransomware-gang-hundreds-attacks

International police seized KillSec servers and 110 terabytes of stolen data after tracking a ransomware operation allegedly led by a teenager​

​

Investigators also uncovered another detail that caught my attention. Europol says members of KillSec used artificial intelligence to help build and maintain ransomware infrastructure and identify potential victims.​

This is the second 16 year old connected to these groups. The other was party of ShinyHunters that hit the FBI recently. He was from Amman, Jordan.

 

[YosemiteSam]

I asked AI about this:

• According to the Verizon Data Breach Investigations Report, about 96% of ransomware victims (where organization size was known) were small or medium-sized businesses.

The general consensus was 90%+ were businesses/organizations and less than 10% were individuals.

Most of these hacks occur through social engineering and ~60% of them are from 3rd party providers who were given access to corporate networks.

Careful when small business hire an MSP to run their IT departments.

oh MSP = Managed Service Provider.

 

[Reality]

Most of these hacks occur through social engineering and ~60% of them are from 3rd party providers who were given access to corporate networks.

Careful when small business hire an MSP to run their IT departments.

oh MSP = Managed Service Provider.

Yeah, that's the factual bit of hacking most people rarely understand.

The most common and easiest ways to hack something is to talk someone into giving you access or to get someone to run something on their computer that gives you remote access.

The 3rd party providers as well as things like plugins, extensions, etc. are way easier to exploit than the primary targets.

For example, people assume things are safe but that longtime trusted browser extension you've used for years just got sold to a hacking group for $50k and now they have 500,000 installs they can exploit and your logins are all being logged and reported to their servers.

 

[VaqueroTD]

This is the second 16 year old connected to these groups. The other was party of ShinyHunters that hit the FBI recently. He was from Amman, Jordan.

When putting money on which group will end the world first - the military and AI, hackers from Iran or rogue states, and so on.... my money is on that 15-year-old brilliant kid who gets in over his head and has the social maturity of a pineapple.

 

[zrinkill]

Whoever arrested him will let him sit in a cell for a few months then give him "parole" and put him to work for them.