Hacker News Reader

Comment by nprz | Hacker News Reader

So why are ransomware hackers never prosecuted?

Usually it involves conversion of illegally gained assets into untraceable cryptocurrencies such as XMR (Monero) and then subsequent funneling and conversion of those assets back into USD via offshore exchanges.

IRS is offering $625,000 USD to anyone that can crack the Monero algorithm [1].

[1] https://www.forbes.com/sites/kellyphillipserb/2020/09/14/irs...

> conversion of those assets back into USD via offshore exchanges.

They would probably not exchange into USD, there are plenty of other currencies and they would probably favor a local currency.

Because trackable doesn't mean "always trackable to a real human identity who's the original source". Bitcoin transactions are trivial for anyone to track, since everything is recorded on the public blockchain, but you can't necessarily follow the trail to the true culprit even if you're law enforcement. Especially if there are non-cooperative entities in the chain who are completely outside of your jurisdiction.

Though, the true answer to your actual question is what the other commenter said: it's mainly due to the Russian government turning a blind eye to it as long as they don't target Russian/ex-USSR citizens. So even if you do know a ransomware operator's full name and home address and everything else you can possibly know about them, you can't do anything about it besides hope they leave the country and try to catch them then.

> So why are ransomware hackers never prosecuted?

Because they're typically based in Russia, and Russia has a policy that it will not prosecute its citizens for computer crimes unless they perpetrated them against Russians or Russian organizations. My understanding is most ransomware has code to detect Russian computers (e.g. by checking localization settings), and will refuse to run if it finds itself on one for that reason.

https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

So why not just send the payment to a Russian bank?

> So why not just send the payment to a Russian bank?

I don't know, I'm not a Russian in the ransomware business.

But I speculate that doing it that way might be so blatant and inconvenient to the Russian government that it might get the policy that protects them changed. Also, I'd imagine any bank that accepts such payments would quickly get itself blacklisted. This stuff isn't actually binary, so it's not smart to take it to the limit.

Because Russian banks need to be capable of transacting with American banks and directly receiving money that is Ransom Payment related is a bad business decision.

So you're saying sending money to a bitcoin address would help obscure the identity of the receiver?

No I'm saying a Russian bank probably doesn't look past the deposit. But if the deposit comes from America then an American bank will ask for it back when the US govt tells it to and then the bank will do so because it's good business. So I would imagine most ransomware gangs just keep the money in bitcoin and only pull out what they need to when they need to.

Why not set all US system to have russian locale?

That is actually done by some orgs for security purposes.

If there's one thing I've learned, it's that illegality is irrelevant. Only what laws are enforced, and how quickly they are enforced, matters.

Because they live and operate in jurisdictions without extradition treaties.

So they might as well just ask for their ransom via a wire transfer or paypal? Since their identity will be known anyway.

If ransomware used PayPal accounts or bank numbers those payments would quickly start being censored to cut off their payment rails. The value of crypto is all rooted in censorship resistance, not anonymity.

Wouldn't it have to be an agency in their own jurisdiction that would prevent the hacker from accessing banking services? They would make an effort to shut down the hackers bank account but not prosecute them?

The pressure point in the traditional financial system is not the Russian authorities cutting off the Russian hacker from a Russian bank, it's SWIFT cutting off the Russian bank from the global financial system.

Because they typically operate out of jurisdictions that don't feel like prosecuting them.

Why not just ask for a paypal or a wire transfer then? If they don't care about revealing their identity?

Those are usually easily reversible.

Reply on news.ycombinator.com