{"id":23587,"date":"2023-12-13T05:21:02","date_gmt":"2023-12-13T13:21:02","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2023\/12\/13\/news-17317\/"},"modified":"2023-12-13T05:21:02","modified_gmt":"2023-12-13T13:21:02","slug":"news-17317","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2023\/12\/13\/news-17317\/","title":{"rendered":"Press and pressure: Ransomware gangs and the media"},"content":{"rendered":"

Credit to Author: Matt Wixey| Date: Wed, 13 Dec 2023 11:00:25 +0000<\/strong><\/p>\n

\n

Historically, threat actors weren\u2019t keen to engage with journalists. They may have followed press coverage about themselves, of course, but they rarely courted such attention; staying under the radar was usually much more important to them. The idea of attackers regularly putting out press releases and statements \u2013 let alone giving detailed interviews and arguing with reporters \u2013 was absurd (even if they were sometimes very willing to publicly argue with each other<\/a>).<\/p>\n

And then came the ransomware gangs.<\/p>\n

Ransomware has changed many facets of the threat landscape, but a key recent development is its increasing commoditization and professionalization. There\u2019s ransomware-as-a-service<\/a>; logos and branding (and even paying acolytes to get tattoos<\/a>) and slick graphics on leak sites; defined HR and Legal roles<\/a>; and bug bounty programmes<\/a>. Accompanying all this \u2013 alongside the astronomical criminal gains<\/a> and the misery heaped on innumerable victims \u2013 is a slew of media attention, and an increasingly media-savvy assortment of threat actors.<\/p>\n

Far from shying away from the press, as so many threat actors did in the past, some ransomware gangs have been quick to seize the opportunities it affords them. Now, threat actors write FAQs for journalists visiting their leak sites; encourage reporters to get in touch; give in-depth interviews; and recruit writers. Media engagement provides ransomware gangs with both tactical and strategic advantages; it allows them to apply pressure to their victims, while also enabling them to shape the narrative, inflate their own notoriety and egos, and further \u2018mythologize\u2019 themselves.<\/p>\n

Of course, it\u2019s not always a harmonious relationship. Recently, we\u2019ve seen several examples of ransomware actors disputing journalists\u2019 coverage of attacks, and attempting to correct the record \u2013 sometimes throwing insults at specific reporters into the bargain. While this has implications for the wider threat landscape, it also has ramifications for individual targets. In addition to dealing with business impacts, ransom demands, and reputational fallout, organizations are now forced to watch as ransomware gangs scrap with the media in the public domain – with every incident fuelling more coverage and adding further pressure.<\/p>\n

Sophos X-Ops conducted an investigation of several ransomware leak sites and underground criminal forums to explore how ransomware gangs are seeking to leverage the media and control the narrative \u2013 thereby hacking not only systems and networks, but also the accompanying publicity.<\/p>\n

A brief summary of our findings:<\/p>\n