In a sign of just how large the ransomware business is becoming, security vendor F-secure recently posted 34 pages of conversations between ransomware victims and the thieves’ “customer support representatives”.  Ransomware has become so lucrative that data thieves are hiring employees to help victims pay them – after all, they’d rather have your money than your data.

Customer support can increase the payment deadlines (delaying the deletion of your data), provide detailed instructions on how to get Bitcoin (the only accepted currency for unlocking data), and even sell insurance against future ransomware infections.  If you post a review online stating that you did get your data back after paying the thieves, they will refund a small portion of the payment as a ‘thank you’.

Here are a couple of exchanges between the crafters of the Spora ransomware family and victims:

Victim 1: I cannot pay with bitcoin. How can I pay?

Support: Why you cannot pay via bitcoin? Check https://localbitcoins.com site

Victim 1: I tried, too difficult to me

Support: I will send you detailed instruction in few hours. Wait please

Victim 2: What guarntee I have that you restore all my files after my transfer ?

Support: 1. All payments on the site are instant. 2. You can try free file restore to make sure, that your key is acceptable for your files. 3. Read the reviews on trusted websites. 4. Make small transactions.

Victim 3: So, how does the Immunity purchase work? What happens if I buy it?

Support: PC which has immunity will be restored for FREE if it somehow will happen again. (after first full restore) Thank you for question

Want to learn more about how to protect your business against Ransomware?  WingSwept is hosting an upcoming Breakfast and Learn on May 9th^th with Engineering Manager Jon Sparks on “Protecting Your Organization from Ransomware, Phishing and Viruses”.  Call us at 919.779.0954 or email us at support@wingswept.com to learn more!