Russia(gate/bot) Most Ransomware has Links to Russian Hackers

[Husky_Khan]

Estimations that $400 million worth of payments went to groups "highly affiliated with Russia." Also noted is that this report only looks at the flow of money, sent many Ransomware operations rent out tools to affiliates.

Chainalysis, which carried out the research, said it was able to follow the flow of money to and from the digital wallets of known hacking groups using public blockchain transaction records.
Analysts say they know which hacking groups are Russian because they display various characteristics, for example:

• Their ransomware code is written to prevent it from damaging files if it detects the victim's computers are located in Russia or a CIS country
• The gang operates in Russian on Russian-speaking forums
• The gang is linked to Evil Corp - an alleged cyber-crime group wanted by the US

The research is further evidence that many cyber-criminal groups operate either in Russia or in the surrounding Commonwealth of Independent States (CIS) - an intergovernmental organization of Russian-speaking, former Soviet countries.

However, the report only looks at the flow of money to cyber-criminal gang leaders, and many run affiliate operations - essentially renting out the tools needed to launch attacks to others - so it's not known where the individual hackers who work for the big gangs are from.

Russia however denies the allegations, with Puting stating that "Russia is not listed in this ranking of countries that see the most significant number of cyber-attacks from their territory," and that they do not harbor cybercriminals.

74% of ransomware revenue goes to Russia-linked hackers

Crypto-currency researchers say more than $400m of cyber-crime funds go to Russian gangs.

www.bbc.com

 

[Rocinante]

Those of us in infosec pretty much already knew this.

I worked at a hospital system until recently.

We blocked tons and tons of suspicious activity from Russia.

 

[Buba]

I found a "give us cash or we tell everybody about your porn" email in my spam folder three years ago ... after it had been there for a year or two ...