There's an iterated prisoner's dilemma, I wouldn't go as far as calling that honour.

Only to the extent that they derive value from being perceived as consistent.

You could have Googled it, but you can start with https://en.wikipedia.org/wiki/Mirai_(malware)

Mirai is malware that was written by a college student but their code was released to the public, and a lot of other malware uses it as a base.

It (and other malware) tend to behave in specific ways and follow specific patterns, and those patterns can be analyzed. Ditto for the servers they use, targets they hit, etc.

These approaches are known as TTPs, and documenting them is how you attribute an attack to a specific group or actor. Even if you change your org and start using servers in a different country eventually your MO will give you away.

These approaches are cataloged by IT security types, and many cybersecurity orgs release publications about Group X using approach Y.

So when you get hacked by Group Z, but they sound like X and Y, you guess it was them. And if Group X has a history of burning ransom payers then you don't pay -- they'd fuck you anyway, so save the money and start rebuilding.

It's more like, "Security Company X says this gang has behaved predictably in their previous interactions."

SilkRoad was a dark web market, so the comparison from the parent is a bit strange for me, but regarding your comment on reviews, yes they're very important and for the sites I've used, the reviews have been very reliable and useful.

My understand is that since it's a much more limited market, access is very difficult even under normal circumstances (not because of security but just because dark web markets usually have awful performance for various reasons), so it's a far different review landscape than say shopping on Amazon, at least the ones I have used. The markets themselves were fantastic about refunds/conflict resolution, better than most normal online shops. Reputation is key for basically everything dark web, and the main actors in this space are notoriously petty and bold towards anyone that makes it harder to conduct business.

I imagine it's very similar with Ransomware as there has to be some reason for the targets of the attack to believe paying the ransom is worth it, and anyone who upsets that balance for the ransomware gangs unexpectedly becomes rapidly unpopular, and usually a target for the other gangs. It very much so is heavily relying on the honor system, but it seems the groups are committed to such a system.

Most people are inexperienced with the dark web. I would hazard a guess that even most of the HN crowd, as far as having actually used the dark web. There is a lot of fear and misinformation, even when it comes to a tech-literate crowd. People fear government agencies infiltrating the servers that they might visit, and that server dropping malware/spyware that reveals their identity. Even just having your name associated with visiting a darknet market could be disastrous for your reputation, and I assume this is the line of thinking most people give to the idea of visiting these servers. Unfortunately, this line of thinking keeps people away, which actually reduces the ability to stay anonymous as compared to having lots of traffic moving through Tor.

Or at least the ZZZ corps if they made it that far down the alphabet.

The lesson is that hiring "ZZZ Lawn Care" is a really bad idea.

Nah, back in the old days A1 Locksmith or AAA Windshields were just competing for top placement in the (alphabetized) phone book.

Look to Amazon for new ideas on DGA-derived names for your fly-by-night business.

You're assuming it's their real name...

When he was a teenager and had a business under his own name he’d get in trouble sometimes because he’d close all the deals himself then hire other kids to go out and do the work.

Some homeowners thought it was going to be him cutting their lawns and would get upset because the contract said he’d do it. So he’d just rip up the contract in front of them and refuse to cut their lawn ever again.

In Florida there were so many houses with lawns in so many subdivisions he was always busy anyway. Plus he liked getting into fights with adults. Win win, I guess.

Govts should make funding ransomware groups a criminal offense. The money likely going to RU and NK anyway.

> All companies and governments should take the stance that any randomwared or compromised data is now public.

That's a somewhat reasonable stance. You definitely have no guaranteed assurance that it won't be leaked. However... depending on what you do have set up, you may have some reasons to believe that 45GB of encrypted data has not left your internal network (i.e. was only encrypted-in-place)

> And if they don't have the backups, then they should consider it permanently lost.

That's easy to say but way harder in practice. If the data in question is the design artifacts from a billion dollar project... it'd be a pretty hard sell to convince everyone "woops, we fucked up, billion dollars gone, time to close the doors and go home, we definitely shouldn't consider paying $500k or $1M or whatever they want to get all this data back".