Hacker News Reader

Comment by mrb | Hacker News Reader

What a clickbait headline. A paltry $3k and yet the article calls this a "MASSIVE ransomware outbreak". I would be curious to see what a "minor" outbreak is.

View on HN

In Ukraine, banking services nationwide as well as credit card payments on the metro in Kiev, and the airport IT systems, are all down. At what point do we call it massive? When US banks and airports start having trouble?

That's interesting. I've heard a lot about Russia testing out cyberwarfare in Ukraine as a possible proving ground for future targets. Was Ukraine the hardest hit by this latest one?

It'd be interesting if this were actually made to take down infrastructure under the guise of ransomware.

Apparently initially the thing spread through the update of a popular Ukrainian accounting software [1], infecting a lot of networks of Ukrainian companies.

[1] me-doc.com.ua

Ukraine seems to be explicitly targeted, with the initial distribution happening already for some time but having a trigger to start lateral infection (which would be detectable) only 27th June 10:30 ( https://twitter.com/CyberpoliceUA/status/879825132088426499 ) and the actual ransom attacks only some hours after that; so it was intended to spread locally before attracting global attention.

There are reports of hundreds to thousands of machines infected across multiple firms in multiple countries. I'd bet >99% of people are never gonna send the $300 in bitcoin to decrypt their machine, instead they'll just clean and restore as much as they can. The $3k is 11 people desperate to restore all their data now, more may come in the future after people have exhausted other options, but the vast majority will never pay unless their backups were hit too.

Exactly. This is a huge attack. The amounts paid don't mean a thing.

Seems like a better approach would be to have the ransom increase higher after every person that paid. Just so you'd have some competetion to pay sooner.

The conversion rate is likely very, very low for these, especially so soon after infection.

You are right. I misjudged.

Amount of money collected != scale of attack. Number of machines + importance of companies/systems = scale of attack.

it's not, my previous company took everything offline - they got infected via connections to their offices in Ukraine. lots of companies in the Ukraine are infected.

company I work for disabled all working from home VPN accounts for the time being until we do a security audit

obviously, that number will grow

Reply on news.ycombinator.com