AAA warns on gas prices, North Carolina invokes emergency as hackers apologize

I don’t know about the simulation part. But we definitely live in the future...

Imagine a world where the hackers form a union in order to have more input into their targets.

If they didn’t say this, this could be construed as an attack on America and label them as enemies of the state or even terrorists.

"We did not realize that the toe we poked was attached to an extremely large bear. Furthermore, we had never even realized that our chimney's diameter was slightly larger than that of an AGM-65. For that, we and our protectors are extremely sorry.

Until we can shift our assets and upgrade our chimney, we promise to refrain from poking large-ish toes. Nevertheless, we do poke toes, so we must continue to poke small ones.

We are sure that everyone understands the nuanced and unexpected realities of our predicament, especially those voters who can't get to work today."

This is hilarious. "We're just straightforward parasites on society! We only meant to cause moderate amounts of harm! We will improve our practices going forward!" It honestly reminds me of the social media CEO song and dance every time they're in hot water with Congress.

It won't work as well for the hackers, of course, as they aren't paying for lobbyists, crisis PR, and political donations, however much they're trying to be more "professional". [1] I expect this ransomware crew just got a 10x bump in the number of federal agents going after them.

[1] https://www.wired.com/story/ransomware-gone-corporate-darksi...

A state-sponsored operative would say the same thing though.

Wow, “ethical” hackers.

Wouldn’t this add to their “liability” given that now are they not only selling hacking tools but greelighting specific illegal activity?

I've been reading a lot of discworld lately, so this scans very well as a rather awkward conversation between Lord Vetinari and the head of the Thieves' Guild.

"don't let me detain you."

It's very straightforward. They are terrified of being treated as a national security threat instead of as criminals. If they are treated as terrorists, there are far fewer restrictions on how the state can pursue them, far more resources available, and possibly a more capable team pursuing them.

> We truly do live in a simulation.

No, we truly live in a world where human beings have decided that it is ok to exploit others for their own gain. These criminals use corporate-speak because that's the language of exploitation.

Arguably, the scrape is better than the original.

I have never heard of this happening ever.

I think they are worried. When the USA puts their focus on a single thing, usually they can crack the case. See Ross Ulbricht / Silk Road.

The hacker group gives part of their profit to charity and does not attack hospitals or non-profits.

It's unusual. But this hack was also unusual. All the rest I'd heard of had much more localized ramifications. This one they hit too hard and I'm not sure the apology will be enough to stop what they have probably put into motion.

It sure sounds like they messed up big time, and it could cost them. I'm sure Putin will never do anything to them while they are in Russia, but the moment they step out of the country to spend some of their money, all bets are off.

They deserve to be hunted down and punished accordingly. When your need to scam people out of money hurts many people and an economy, I say, "Screw You!!."

This is highly atypical, but they are probably worried. They just created a geopolitical incident that Russia has to clean up, and I would imagine there will be consequences for the group.

The hackers who locked an hospital and caused the death of a woman in Germany also promised to be more careful next time.

Somewhat similar: After a ransomware attack on a German hospital where one person died as a consequence, the attackers gave away the encryption key for free.

> The attackers reportedly withdrew the extortion demand and provided a decryption key to unlock the servers. The justice minister report said that the attackers are no longer reachable.

https://www.wired.com/story/a-patient-dies-after-a-ransomwar...

I remember there being a similar statement after a hospital ransomware attack last made the news here. Now that I'm looking for it there are a lot of hospital ransomware attacks that didn't show up on my radar.

It makes sense from a pure self-serving rational perspective. They don't want to become target of a well-funded investigation or be held responsible for damages above and beyond some unimportant business network. They want to blend in with the background of 1000 other ransomware attacks per day and make money.

These groups are oddly professional. Excellent "customer" service and they care a lot about their reputation. Well, at least their reputation in reliably unlocking the data. It makes sense when you look at them as a business interested in making money. It's better for them to stay a (relatively) minor annoyance. If they reach the level of geo-political threat then suddenly governments will devote a lot more resources to shutting them down.

Relevant:

>Leo Rosten in The Joys of Yiddish defines chutzpah as "gall, brazen nerve, effrontery, incredible 'guts', presumption plus arrogance such as no other word and no other language can do justice to". In this sense, chutzpah expresses both strong disapproval and condemnation. In the same work, Rosten also defines the term as "that quality enshrined in a man who, having killed his mother and father, throws himself on the mercy of the court because he is an orphan."

Chutzpah amounts to a total denial of personal responsibility, which renders others speechless and incredulous ... one cannot quite believe that another person totally lacks common human traits like remorse, regret, guilt, sympathy and insight. The implication is at least some degree of psychopathy in the subject, as well as the awestruck amazement of the observer at the display

Honestly, it feels like there may be an international game of terrible idea chicken going on.

They opt for convenience instead of security... Infrastructure like this should not be able to be controlled remotely... but of course this is common sense.

I'm imagining a story about a group of teenage hackers who accidentally put ransomware on important government infrastructure and the government offers them a ton of money so they have to pretend to be a serious hacking organization to keep up face

That doesn't change their point. It just means that creating problems for society may or may not be an acceptable consequence

Power outages are also a thing...

There isn't a clear dividing line. What you have are criminal organisations who may get protection and shelter from governments in exchange for making attacks which are incidentally beneficial to that government.

As far as we know the attack didn't even touch the systems connected to hardware.

Hear hoofbeats, think horses.

The skillset to compromise large enterprise networks is more readily available and more profitable than the skillset to compromise SCADA systems, and for all the flak they get, the culture at most large engineering firms in the West is extremely safety conscious. If it's not provably operating safely, it isn't. So it gets shut down.

So you all need to do is deny the link between the actual control system and lines of engineering reporting.