re: Colonial Pipeline gave in: $5,000,000 paid to ransomware hackers

quote:

---

Cowards


How did they guarantee the hackers weren't pulling a Nigerian prince scheme and would fix the code after payment?

---

For a ransomware outfit, Darkside seems to care a lot about their reputation/PR. They offer tech support and even consulting on how to harden the victim's network after the ransom is paid

A Closer Look at DarkSide

As for being cowards, it is really a business decision and not a how bold/brave are you. Is it better/cheaper to pay the ransom, or can we get everything back up ourselves for cheaper (unlikely unless your business can be down for ~1000 years or you are a leader in the quantum computing sector), is it cheaper to restart from scratch.

quote:

---

How did they guarantee the hackers weren't pulling a Nigerian prince scheme and would fix the code after payment?

---

Because if word got out that they didn't unlock everything, then they'd never get another ransom payment again. To keep the scam going, you have to deliver on your side of things.

I said it in another thread related to this, but we got hit one time with ransomware, but we were back up within a couple hours because we had a solid recovery protocol. Granted we're smaller than Colonial, but still. Our IT guys nuked the system, did a restore, and we were good to go. It infected a couple dozen workstations, including our main manufacturing server. It was money well spent to be prepared.