https://www.zdnet.com/article/these-ransomware-crooks-are-complaining-they-are-getting-ripped-off-by-other-ransomware-crooks/ Search What are you looking for? [ ] Go * Videos * Windows 11 * 5G * Best VPNs * Cloud * Security * AI * more + Working from Home + Innovation + Best Web Hosting + ZDNet Recommends + Tonya Hall Show + Executive Guides + ZDNet Academy + See All Topics + Downloads + Reviews + Galleries + Videos * Edition: + Asia + Australia + Europe + India + United Kingdom + United States + + ZDNet around the globe: + ZDNet France + ZDNet Germany + ZDNet Korea + ZDNet Japan * Newsletters * All Writers * + Preferences + Community + Newsletters + Log Out * * + What are you looking for? [ ] Go * Menu + Videos + Windows 11 + 5G + Best VPNs + Cloud + Security + AI + Working from Home + Innovation + Best Web Hosting + ZDNet Recommends + Tonya Hall Show + Executive Guides + ZDNet Academy + See All Topics + Downloads + Reviews + Galleries + Videos * us + Asia + Australia + Europe + India + United Kingdom + United States + + ZDNet around the globe: + ZDNet France + ZDNet Germany + ZDNet Korea + ZDNet Japan * * + o Preferences o Community o Newsletters o Log Out Ransomware gangs are complaining that other crooks are stealing their ransoms Ransomware gangs are shocked to find out that cyber crooks will scam other criminals if they can. * * * * * * * Danny Palmer By Danny Palmer | September 30, 2021 | Topic: Security [20210611-hultquist-danny] Ransomware is a big cybersecurity problem: Why and what needs to be done to stop it? Watch Now Cyber criminals using a ransomware-as-a-service scheme have been spotted complaining that the group they rent the malware from could be using a hidden backdoor to grab ransom payments for themselves. REvil is one of the most notorious and most common forms of ransomware around and has been responsible for several major incidents. The group behind REvil lease their ransomware out to other crooks in exchange for a cut of the profits these affiliates make by extorting Bitcoin payments in exchange for the ransomware decryption keys that the victims need. ZDNet Recommends * Best VPN services * Best security keys * Best antivirus software * The fastest VPNs But it seems that cut isn't enough for those behind REvil: it was recently disclosed that there's a secret backdoor coded into their product, which allows REvil to restore the encrypted files without the involvement of the affiliate. SEE: A winning strategy for cybersecurity (ZDNet special report) This could allow REvil to takeover negotiations with victims, hijack the so-called "customer support" chats - and steal the ransom payments for themselves. Analysis of underground forums by cybersecurity researchers at Flashpoint suggests that the disclosure of the REvil backdoor hasn't gone down well with affiliates. One forum user claimed to have had suspicions of REvil's tactics, and said their own plans to extort $7 million from a victim was abruptly ended. They believe that one of the REvil authors took over the negotiations using the backdoor and made off with the money. Another user on the Russian-speaking forum complained they were tired of "lousy partner programs" used by ransomware groups "you cannot trust", but also suggested that the status of REvil as one of the most lucrative ransomware-as-a-service schemes means that wannabe ransomware crooks will still flock to become affiliates. That's particuarly the case now the group is back in action after appearing to go on hiatus earlier in the summer. For those scammers who think they've been scammed, there's not a lot they can do (and few would have sympathy for them). One forum user suggested any attempt at dealing with this situation would be as useless as trying to arbitrate "against Stalin". Ransomware remains one of the key cybersecurity issues facing the world today. For victims of ransomware attacks, it ultimately doesn't matter who is on the other end of the keyboard demanding payment for the decryption key - many will just opt to pay the ransom, percieving it as the best way to restore the network. ZDNet Recommends The best cloud storage services The best cloud storage services Free and cheap personal and small business cloud storage services are everywhere. But, which one is best for you? Let's look at the top cloud storage options. Read More But even if victims pay the ransom - which isn't recommended because it encourages more ransomware attacks - restoring the network can still be a slow process and it can be weeks or months before services are fully restored. SEE: A cloud company asked security researchers to look over its systems. Here's what they found Be it REvil or any other ransomware gang, the best way to avoid the disruption of a ransomware attack is to prevent attacks in the first place. Some of the key ways organisations can help stop ransomware attacks is to make sure operating systems and software across the network is patched with the latest security updates, so cyber criminals can't easily exploit known vulnerabilities to gain an initial foothold. Multi-factor authentication should also be applied to all users to provide a barrier to hands-on attackers being able to use stolen usernames and passwords to move around a compromised network. MORE ON CYBERSECURITY * Ransomware attackers targeted this company. Then defenders discovered something curious * Ransomware: This amateur attack shows how clueless criminals are trying to get in on the action * FBI reportedly withheld ransomware key from business for 3 weeks in failed sting * This major ransomware attack was foiled at the last minute. Here's how they spotted it * Ransomware: These are the two most common ways hackers get inside your network Related Topics: Security TV Data Management CXO Data Centers * * * * * * * Danny Palmer By Danny Palmer | September 30, 2021 | Topic: Security Show Comments LOG IN TO COMMENT * My Profile * Log Out | Community Guidelines Join Discussion Add Your Comment Add Your Comment More from Danny Palmer * [][android-malware] Security Password-stealing Android malware uses sneaky security warning to trick you into downloading * [][woman-working-from-home] Security Digital transformation is creating new security risks, and businesses can't keep up * [][password-123456-written] Security These systems are facing billions of attacks every month as hackers try to guess passwords * [][gettyimages-doctor-and-] Security Ransomware attacks against hospitals are having some very grim consequences Please review our terms of service to complete your newsletter subscription. [ ] You agree to receive updates, promotions, and alerts from ZDNet.com. You may unsubscribe at any time. By joining ZDNet, you agree to our Terms of Use and Privacy Policy. [ ] You agree to receive updates, promotions, and alerts from ZDNet.com. You may unsubscribe at any time. By signing up, you agree to receive the selected newsletter(s) which you may unsubscribe from at any time. You also agree to the Terms of Use and acknowledge the data collection and usage practices outlined in our Privacy Policy. Continue Newsletters See All See All Related Stories * 1 of 3 * * [][sale-303120-article-ima] Get training on Microsoft, Cybersecurity, Python, GDPR, and more with this master class Now you can learn the skills for as many as six certifications in Python, CompTIA Cybersecurity, ITIL and GDPR even while working full-time. * [][img-1650] Everyone needs to buy one of these cheap security tools If you have important online accounts, you need one (perhaps, two) of these. * [][img-1614x] This feature could stop you forgetting your iPhone ever again Never leave your iPhone behind at the work, school, or bar again. * [][coinbase] Coinbase sends out breach notification letters after 6,000 accounts had cryptocurrency stolen The letters come after thousands of people complained this summer about lackluster customer service from the cryptocurrency platform. * [][shutterstock-1507031834] US Army medical records technician sentenced for stealing $1.5 million from veterans through DoD benefit sites Fredrick Brown was sentenced to more than 12 years in prison for stealing the personal information of thousands of US veterans and their benefits. * [][white-house-cloudy-3] White House to convene 30-country cybersecurity meeting The topics of the meeting, Biden said, will include combating cybercrime, improving law enforcement collaboration, stemming the illicit use of cryptocurrency, building trusted ... * [][spider-man-homecoming] Mozilla: Superman, Batman, Spider-Man dominate list of passwords leaked in breaches Using data from haveibeenpwned.com, Mozilla found that hundreds of thousands of people continue to use their favorite superheroes for passwords. * [][istock-1134000614] Internet safety guide for college students College students face online threats every day. Protect your private data and your identity by taking some simple internet safety steps. * [][neiman-marcus-1-1-milli] Neiman Marcus says May 2020 breach includes millions of payment card numbers and expiration dates The company admitted that the breach occurred more than a year ago but noted that they only discovered it in September 2021. ZDNet Connect with us (c) 2021 ZDNET, A RED VENTURES COMPANY. ALL RIGHTS RESERVED. Privacy Policy | Cookie Settings | Advertise | Terms of Use * Topics * Galleries * Videos * Sponsored Narratives * Do Not Sell My Information * About ZDNet * Meet The Team * All Authors * RSS Feeds * Site Map * Reprint Policy * Manage | Log Out * Join | Log In * Membership * Newsletters * Site Assistance * ZDNet Academy