Ransomware Gangs Engaging the Media

Cybercriminals traditionally hid from publicity, but Sophos reports that over the past few years, ransomware gangs have begun actively engaging with journalists.

They hope published accounts will leverage cooperation from victims, control the narrative about ransom attacks, and help them hook up with affiliates for mutual benefit.

A visit to a threat actor’s ornate and graphically savvy leak site can yield a press release-style fact sheet. Invitations for in-depth interviews often follow. It’s all part of the commoditization and professionalization of the scam.

Sophos investigated several ransomware leak sites and underground criminal forums. They found that ransomware gangs are hyper-aware that their activities are newsworthy. Their goal is to boost their credibility.

They are anxious to recruit English writers and speakers on criminal forums. They facilitate communications with journalists through private PR channels, and notices on their leak sites.

They project a positive view of their activities and are quick to criticize what they consider inaccurate coverage. Sophos claims to have seen examples of ransomware actors disputing journalists’ coverage of attacks, and attempting to correct the record.

Those attempts include insulting specific reporters. The resulting controversy serves to make public spectacles of victims, with each incident spurring more coverage, thus adding further pressure to pay up.

Sophos suggests things that the security community and the media can do now to negate those efforts. They include refraining from engaging with ransomware gangsters unless it’s in the public interest or provides actionable intelligence for defenders; supporting journalists and researchers targeted by attackers; and refusing to name threat actors.