The ransomware hoax gets more interesting

As usual, if something is repeated often enough it just  becomes the truth. I saw even posts here referring to the “ransomware attacks”.

While even as they happened it already emerged that  a) it was just your usual incompetence in operating IT infrastructure, b) it has nothing to do with Russia, Russia RUSSIA, as ever, and most importantly  c)  the pipeline  was shut down deliberately by the operator!    The malware only ruined the accounting system.   The stop was a business decision to avoid potentially ship stuff without billing.     (We had a thread on that at the time it was recent story  with links and everything.)

The narrative succeeded, no one talks about the responsibility of the company. And they can pose as victims to evil enemy hackers and governments.     And customers should not ask trivial questions like how hard it is to make backups these days when any rando is offered gigs for just entering an email address.   Or how much time should recovery take (and never mind avoid using vulnerable exchange services with critical bugs exposed years ago with available patches and alternatives…)

At the time I recall claim that ~ $5M worth of BTC was paid as ransom, then they just recovered the systems from their backups anyway due to “decryption going too slow”.    Another super fishy story on many levels.  

First, you don’t pay ransom out of principle, period. And I would not expect to get anything from paying anyway.  Then, in the miracle case you actually get the decryption keys for your data, then it takes almost no time to decrypt. If it’s slow, then they just got some generic brute-force decryptor. Meh.

Even at the time I raised suspicion that some insiders could not resist the opportunity and offer their own address to pay the “ransom” to, nice free money.

Now I read this:

https://www.france24.com/en/americas/20210607-us-recovers-most-of-ransom-paid-to-colonial-pipeline-hackers

Read it carefully.  The FBI figured out some BTC secret keys involved.   That is certainly not possible for keys held by “russian hackers”.  They only wish the blockchain worked that way.    Only for domestic  POIs.   In this case someone in California.  Not exactly Putin’s neighbor.

And it’s so appalling that even the article that writes about these things can’t resist to turn back to the original narrative it just refuted.    Just as Snowball lurking in the shadows and stealing the produce during the night.