Welcome!
Craig explains the new Corporate face of Ransomware called Ransomware-as-a-Service or RaaS. How it works and what it means for you the small business owner.
For more tech tips, news, and updates visit – CraigPeterson.com
—
Read More:
Managed IT Providers: The Cyber-Threat Actors’ Gateway to SMBs
Think You’re Spending Enough on Security?
DHS Braces For ‘Potential EMP Attack’ As Presidential Election Nears
US Sanctions Russian Attackers for 2020 Election Interference
Cyber-Risks Explode With Move to Telehealth Services
Why online voting is harder than online banking
Price gouging and defective products rampant on Amazon, reports find
Ransomware Has Gone Corporate—and Gotten More Cruel
—
Automated Machine-Generated Transcript:
Craig Peterson: [00:00:00] Odds are pretty good, actually that you’ve already been hit with ransomware. Raise your arm if it’s happened to you, put your hand up. Yep. Yep. I see you. it has gotten a lot worse lately.
You’re listening to Craig Peterson right here on news radio 98.5 FM, AM 560, and of course, online@craigpeterson.com. Thanks for joining me today. And of course, during the week, every morning, Matt Gagnon is on Monday through Friday. You can listen to him during your morning drives and I’m on with him on Wednesdays as well at seven 34.
We’ve talked about a lot today and if you missed any of it, you can find it online at my website. You can also subscribe to my podcasts if you would like. Can just go to Craig peterson.com/itunes. Hopefully, I have earned a five-star rating from you. And if that’s the case by all means go, if not, then don’t. Hopefully, I have, we put a lot of work into this every week. I do certainly. My wife helps out with it. She does a lot of editing of the podcasts and putting everything together. Of course, we put it up on the radio stations. Appreciate all of the work Danny does there and just getting it all together. It is a lot of work and I’d love to hear from you if you have any comments or questions, by all means, let me know. Or, if you’re interested in attending some of these training that I’m scheduling over the next few weeks. Drop me a note. Just email me M E @craigpetersawn.com. I’d love to hear from you. And if you’d like to get my weekly newsletter and find out a little bit more about what’s going on through the three-minute emails. So then I’m going to be sending out and I call them three minutes because you’re going to get a tip, in just about three minutes, as well as some action items that you can do. So you can get that by going to Craig peterson.com/subscribe, pretty easy. And I am not, I’m going to nail you. I’m not one of those people that just chugs away trying to sell you something. Just to ask anybody who has subscribed to that email list. I send those things out and I do respond to emails. Might take me a few days. Sometimes depends on where I am and what’s going on. But just me, ME @craigpeterson.com.
Ransomware has taken a turn for the worse. And there’s a great article by Brian Barrett up on Wired, this week. And I’ve got it up on my website as well @craigpeterson.com. But ransomware has gone corporate now. It’s gotten a lot crueler. These operators, just the latest groups here to adopt what really looks like a professional attitude. This group is called Dark Side. Now, in case you don’t know how this works you probably have misconceptions about how the whole ransomware business runs.
It’s a business now, and you can make money, millions of dollars running a ransomware business. Now you might think that you have to go out and you have to hire a programmer and, maybe a few programmers and write some software that goes out and first of all, of course, you got to find a hack that works. What have people not yet patched on their windows boxes or maybe what have they not changed on their firewalls they haven’t patched them up, so right. That would be step one, right? A logical step one. So you’ve got to find this.
Then of course, if people start patching that, then you’ve got to find the next one and you got to have, so you’ve got the hackers upfront, right? So you’ve gotta have a team of hackers.
Then what do you have to have? Let me see you need some programmers who can now program to use those hacks to your best benefit. It’s going to crawl the internet. It’s going to find these systems that are vulnerable. Then what you’re going to have to do is have another team of programmers that are going to have to write code, to infect those machines, using the hack that was found by your hacker team.
Once that hacker team has found that, and you now have a hack that works. You now have to get it out in people’s hands. So you have to have somebody that writes some emails that are phishing style. That’s how most of it’s spread, nowadays and that fishing style has to get people to click on it. It’s not like the Nigerian Prince scams. Those are, those were so 1990s. No, we’re talking about some professional email. So let me see how many people do we have. We’ve got the hackers and that’s a few people, right? And so they’re probably going to be mostly full time because hacks don’t work forever and then you gotta have the programmers that can program to find machines that are vulnerable. Then you have to have the programmers that take that hack into those vulnerable machines and can now encrypt all of their data. Then you’ve got to send the information back from the machines that have been encrypted to let you know, Hey, this machine has been encrypted here, so how much money do we want out of these people, We need Bitcoin? So we have to have somebody that manages the Bitcoin account, make sure the money’s coming in and then we have to have other people that send it back. Doesn’t that make sense to you? As that’s the way it would have to work.
You would be wrong. Yes. All you need nowadays to become a ransomware corporation is anywhere from 20 to a hundred dollars. You go onto the dark web, which is very easy to get on to. I’ve given you guys instructions on that before here on the radio show because there are legitimate reasons to go out onto the dark web, but you go on the dark web and you pay.
In fact, did you realize that you don’t even have to buy the ransomware software anymore? Yeah. You could pay 20 bucks for some ransomware software, but now there are companies that provide ransomware as a service, and these ransomware-as-a-service companies like DarkSide, which is what I’m talking about right now, they’ll do it all for you. They’ll just take a percentage of the profits if you will, the money that you’re swindling out of all of these companies that are out there. Yeah.
So these people, this is amazing, they’ve got a venture capitalist friendly pitch deck that they use. They’re obviously not as strict and they say in this pitch deck that we created DarkSide because we didn’t find the perfect product for us. This is the latest in a strain of ransomware. That’s built to shake down big game targets for millions of years dollars with attacks that have this air of professionalism.
They’ve got tech support people. They’ve got real-time live chat software so that the victims of your ransomware can call. They don’t know what’s going on. They didn’t patch their systems. They weren’t patched up to date. Usually, you have a few weeks between the time that a patch is released and the bad guys really start going after it. Right now, you might even have a month or two.
Heck, it took the huge hugest attack, right where over 200 million people stolen from Equifax, all of your personal information, it took them about six months. So no, after a new hack comes out, you might have a few.
But these guys, they just take care of it for you.
If you haven’t patched because you don’t know how to patch or you don’t want to patch, it’s not your core business. I haven’t hired a good Managed Services Provider (MSP). No one’s going to come after me. These guys come after you.
Now they’d love to get their ransomware paws on to a city government computer, or they’d love to get them on to Equifax, again, but they just as soon get them on you and your personal computer.
How do the bad guys know that you have millions of dollars to pay in ransom? Because if it’s on your computer, you’re a 70, 80, 90-year-old retiree. You don’t have a whole lot of cash sitting around, at least a pretty unlikely. If you’re a very small business, you’re not going to have a lot of cash sitting around. If you’re a big business if you’re a hospital, a school, a nonprofit, government target you do. So how do they find out?
Ransomware today isn’t the ransomware of yesteryear. The ransomware of today gets onto your computer. It starts spreading laterally inside your network, unbeknownst to you because you didn’t bother investing in the right kind of hardware or software to track any of this stuff.
So now it’s on a bunch of your business machines and it gives the bad guys a back door now. Where they go onto your machines and poke around. Their software is even automated. It looks for word documents, Excel spreadsheets, all kinds of documents, even PDFs that might be of interest to them. Then they’d start poking around and say, Whoa, wait a minute.
Here we’re into a police department. I wonder what they would pay to keep all of their records, to get them all back or to keep them secure. Or I wonder what this business would pay to us to not release all of their documents. So they download all these documents from you. And the now they’ve got it figured out. So they actually do have a team that sits there and analyzes it and says, okay, I think we can get. $2 million out of this business or this government agency. They have all of your documents in hand and so they will now present you with a ransom. They will encrypt your machines, just like yesteryear, just like the good old days, they’ll encrypt your machines. Then they will say, Hey, listen here. Now you pay up.
It’s only $2 million who can afford it. You can afford it. If you pay up, we’ll give you a key. We even have tech support people. In fact, you probably are on a real-time chat right now and those tech support people are going to give you a hug and they are going to take care of you. They’re going to decrypt your files.
Odds are, by the way, only about 50% that even if you pay the ransom, you get all your files back. Then they’ll say here’s the other edge of that sword. Hey, by the way, if you don’t pay. By the way, the price is going up in three days, but if you don’t pay, we’re going to release all of your files to the dark web. We’re going to post them up there and they’re going to be in the hands of your competitors, or whoever wants to get their hands on it.
By the way, depending on the industry you’re in, that’s only a 10-year federal prison sentence and how many hundreds of thousands of dollars in fines, nothing to worry about.
They have turned ransomware into a corporate entity. It is very scary.
Make sure you are on my email list. So you can get those three-minute pieces of training. You can attend my free training everything. Especially if you are a C-level within a corporation, if you’re just an individual you’re going to get some great stuff. You’re going to learn stuff.
Really I am trying to train business people on what they should be doing with their systems and with their personnel.
All right. Have a great weekend, everybody.
I’ll be back Wednesday morning with Mr. Matt. Gagnon at about seven 34. We’ll talk to you then.
You’ve been listening to Craig Peterson on news radio 98.5, and AM 560.
Have a great week, everybody.
—
More stories and tech updates at:
Don’t miss an episode from Craig. Subscribe and give us a rating:
Follow me on Twitter for the latest in tech at:
For questions, call or text:
855-385-5553
