{"id":864,"date":"2021-08-04T09:23:00","date_gmt":"2021-08-04T09:23:00","guid":{"rendered":"https:\/\/dev.cryptoloc.au\/?p=864"},"modified":"2023-10-03T06:19:54","modified_gmt":"2023-10-03T06:19:54","slug":"the-new-cartels-whos-behind-the-rise-in-cyber-crime","status":"publish","type":"post","link":"https:\/\/127.0.0.1\/the-new-cartels-whos-behind-the-rise-in-cyber-crime\/","title":{"rendered":"The new cartels: Who\u2019s behind the rise in cyber crime?"},"content":{"rendered":"\n

Forget the Hollywood stereotype of the lone hacker living in his mother\u2019s basement and plotting his revenge against the world. Today\u2019s cyber criminals are organised, sophisticated and sometimes state-sponsored. <\/strong><\/p>\n\n\n\n

US officials have confirmed the world\u2019s worst kept secret \u2013 that hackers tied to the Chinese government were responsible for the massive Microsoft Exchange hack earlier this year, thought to be one of the largest cyber attacks in history. <\/p>\n\n\n\n

Hackers contracted by China\u2019s Ministry of State Security are believed to have gained access to the email systems of tens of thousands of private users and public entities, including schools, hospitals and city councils. <\/p>\n\n\n\n

Microsoft blamed the attack<\/a> on state-sponsored hackers operating out of China at the time, but it\u2019s taken until now for the US and its global allies \u2013 including Australia, the UK and the EU \u2013 to formally accuse and publicly condemn China for the attacks. <\/p>\n\n\n\n

Of course, the Microsoft Exchange breach is just part of a recent uptick in cyber crime, which has seen a 200 per cent increase<\/a> in reports of ransomware to the Australian Cyber Security Centre in recent months. <\/p>\n\n\n\n

So how did cyber crime become such serious business, and who\u2019s behind the malware that\u2019s enabling it?<\/p>\n\n\n\n

The rise of ransomware<\/h3>\n\n\n\n

Ransomware \u2013 a form of malware that encrypts the victim\u2019s files, enabling the attacker to demand a ransom for their return \u2013 has come a long way since the early days of the AIDS Trojan in 1989. <\/p>\n\n\n\n

The first known instance of ransomware, the AIDS Trojan hid files on the user\u2019s hard drive and only encrypted their names, not the files themselves. It displayed a message demanding a payment of US$189 to the \u2018PC Cyborg Corporation\u2019 in return for the repair tool \u2013 which was actually completely unnecessary, because the decryption key could be extracted from the code of the Trojan itself. <\/p>\n\n\n\n

Hackers tied to the Chinese government were responsible for the massive Microsoft Exchange hack earlier this year.<\/p>\n\n\n\n

Dr Joseph Popp was identified as the author of the AIDS Trojan and charged with blackmail. A Harvard-trained evolutionary biologist who collaborated with the AMREF Flying Doctors and consulted for the WHO in Kenya, Popp had actually organised a conference for the Global AIDS Program the same year he created the AIDS Trojan, and later promised to donate the profits from the AIDS Trojan to fund actual AIDS research. (He was ultimately declared mentally unfit to stand trial.) <\/p>\n\n\n\n

Much like low-rise jeans, trucker hats and velour tracksuits, it wasn\u2019t until the early-to-mid 2000s that ransomware really began to take hold. Trojans known as GPCode, TROJ.RANSOM.A, Archiveus, Krotten, Cryzip, and MayArchive began using more sophisticated encryption schemes \u2013 by June 2008, GPCode was using a 1024-bit RSA public key, which would have taken computers at the time roughly two million years to crack. <\/p>\n\n\n\n

The decentralised and anonymous nature of Bitcoin made the digital currency an instant favourite with cyber criminals, which led to the creators of CryptoLocker (no relation) collecting roughly US$27 million with their ransomware. A string of copycat variants with names like CryptoLocker 2.0 and CryptoBlocker followed, all with roughly the same MO \u2013 the victim would have three days to pay a bitcoin ransom, or the files would be deleted. <\/p>\n\n\n\n

These early ransomware techniques all relied on the desire of victims to get their files back to motivate them to pay the ransom. But the current ransomware technique du jour<\/em>, \u2018double extortion\u2019, puts a twist on the formula. In a double extortion attack, the criminals don\u2019t just encrypt the victim\u2019s data, but they also copy it to a server of their own. <\/p>\n\n\n\n

That way, even once the victim pays the ransom to decrypt the data, the criminals still have their copy, and can demand a second ransom \u2013 a double extortion, if you will \u2013 by threatening to leak it publicly. <\/p>\n\n\n\n

Ransomware group REvil were the first to use the double extortion tactic in June 2020, when they began auctioning off data stolen from a Canadian agricultural production company<\/a> that refused to meet their ransom demands. But since then, a number of ransomware groups have adopted the tactic. <\/p>\n\n\n\n

Gangs of New Dork <\/h3>\n\n\n\n

Particular ransomware strains have traditionally been associated with particular ransomware groups, who would dissolve after a few big scores and then re-emerge with a new name. <\/p>\n\n\n\n

But now, according to a recent report by cyber risk analytics provider CyberCube<\/a>, these groups have evolved into cyber \u2018cartels\u2019 that operate much like the mafia, collaborating as affiliates to infiltrate their targets\u2019 networks. They share resources, pass on stolen data and attack information, and have even developed a Ransomware-as-a-Service model, sharing their wares with lone scammers in return for a slice of their profits.  <\/p>\n\n\n\n

Under the Ransomware-as-a-Service model, newcomers to the ransomware scene don\u2019t need to have the know-how to develop their own malware, so even the most technically challenged cyber criminal can get amongst it. They\u2019re not likely to pull off big scores on their own, but the relatively small amounts they extort from individuals add up \u2013 a new Australian Institute of Criminology report<\/a> estimated the total annual economic impact of cyber crime at $3.5 billion in Australia alone, with $1.9 billion lost by individual victims. <\/p>\n\n\n\n

High-profile cyber gangs include: <\/p>\n\n\n\n