What a Ransomware Takedown Can’t Fix
A ransomware takedown is a rare bit of good news in this business, so let's enjoy this one. At the end of September, police took over a gang's website, and anyone who visits it now gets a police seizure notice instead.
What actually happened
On September 30, police in Germany, working with authorities in nine other countries, took over the leak site of a ransomware group called KillSec. (A leak site is where these gangs post a victim's stolen files when the victim won't pay.) Now it just redirects to a seizure notice.
Police also took control of five servers, secured at least 110 terabytes of stolen data, searched eight properties across Greece, Romania, Spain and the UK, and provisionally arrested three people. Investigators tie the group to roughly 1,000 attacks, about half of which they've confirmed as successful. The gang publicly named 274 victims, and about a third of them were in the U.S.
The business model is what stuck with me. It ran like a franchise. Affiliates paid a $250 buy-in, went out and did the breaking in, and a cut of every ransom went back to the group: 12% at first, 20% by early 2025. Even crime has a franchise fee that creeps up.
Why this ransomware takedown matters
This is a real win for law enforcement and businesses everywhere. A criminal gang that hit healthcare, banks and an insurer lost its servers, its leak site and more than a hundred terabytes of leverage in one day.
But here's the part that doesn't make the headline. Some of KillSec's affiliates also worked with other gangs, including LockBit, RansomHub and Qilin. The people who do the breaking in don't disappear when one brand gets shut down. They pick up a different logo.
And how they got in is the interesting part. According to the security firm Group-IB, the methods were phishing, guessing passwords on remote desktop connections left open to the internet, known flaws in internet-facing software, and cloud storage that was misconfigured and open to the public. For a lot of victims there wasn't even a break-in. The data was just sitting somewhere anyone could reach it. Late last year the group also started targeting IT service providers, which, really got my attention.
Nobody here was a movie hacker. A lot of this was unlocked doors. That's good news in its own way, because unlocked doors are the cheapest thing in security to fix. You don't need a bigger budget to shut off a remote desktop connection or change a sharing setting. You need someone to look.
What to do about it
Here are three things worth checking this month -if you don’t know, ask your IT Provider:
- Remote access. Is anything on your network reachable from the open internet, like remote desktop, that doesn't need to be? If somebody set it up years ago "just for a week," start there. Open connections like that are exactly what gangs like this go guessing passwords on.
- Cloud storage. Who can open your shared files and folders? Look for anything set to "anyone with the link," and ask whether that was on purpose. Links get created for a quick favor and then never get turned off.
- Updates. Anything that faces the internet, like your firewall, VPN or web apps, should be patched on a schedule, not whenever someone remembers.
The bottom line
One criminal gang is now offline, and that's worth cheering. But the easy ways that it relied on are still open at plenty of businesses, and the people who used them are still out there.
Do you know the answer to these questions, or are you confident your current IT provider knows the answers? This is what Managed IT Cybersecurity and Support firms like ours do all day, everyday for our clients. Contact us if you’d like us to help you make sure your company is protected.
— Rick