https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNX... https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8is... https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6N...
As of now, the three addresses have received a total of about 20 BTC, or about $36,000 at current exchange rates. The most typical transaction sends about $300 to the addresses. No funds have left the addresses yet.
Not enough to make up for having every spy agency on your back. Is there a realistic way to get the funds free and clear even if NSA /FBI /CIA / et al are on your trail?
1. The amount demanded varies from incident to incident. Bitcoin is fractional to 8 decimal places, so it's possible to narrow down the list of victims by the last N digits of the payment.
2. The original demand for payment includes instructions to list the address you sent from. This would be a lame solution for many reasons, including (1) these victims are probably all new to Bitcoin and would have no idea what an address is, and (2) according to an article I read, some security consultants keep a Bitcoin wallet handy to pay on behalf of their clients, leading to duplicate payer addresses.
3. Same as #2 but demanding that the victim include the transaction ID, which is a long hex string. Similar usability issues.
4. It's possible to embed metadata into Bitcoin transactions. As with the prior approaches, victims would likely get this wrong.
Most likely there's a human criminal on the other end of the exchange, and that human matches up victims and payments.
Because the paying victims are surely unsophisticated about Bitcoin and terrified about what is happening to them, it seems likely that the risk of one victim claiming another victim's payment is small, so the manual match-up method is probably the most practical solution from the criminals' standpoint.
Is it really that small? What's stopping a victim from claiming someone else's payment by watching transactions and notifying the criminal that "their" payment has been sent?
Plus, the criminals they might be trying to scam are almost certainly the victims' only hope of obtaining the symmetric encryption key (there are exceptions; some of these programs have been shown to be written by people not entirely clear on how crypto works -- single global key, obfuscated key on client machine, etc.). By definition, the only people interested in paying are the people who have no backups of data they need, so they have no options, and taking the risk of pissing off the criminal doesn't really make sense.
Moreover, for all we know, some victims haven't figured out that they're paying the same people who did the encryption in the first place. From their point of view, this is just like buying antivirus software or taking their computer to Geek Squad.
Sometimes they accidentally weaken the algorithm (like by chopping it's key bits in half through a weak RNG). Crypto is hard, even when the scammer probably has a good grasp. Which is useful in this case.
It's hard to (a) rapidly, (b) silently, and (c) strongly encrypt a critical portion of a business's network.
You can probably choose two.
Possibly the amount is negotiable, or the amount to pay is different across different geographies. (edit: Looks like this exists, based on the Economist's Big Mac Index: https://www.recordedfuture.com/fatboy-ransomware-analysis/ )
Unfortunately the economics probably work out the same way spam does, meaning it won't go away. All it takes is a couple people to pay up to make it profitable, because the criminal doesn't bear the cost of distribution.
If really only 120 people paid, I'd find that quite surprising.
Is this just from the one version? Or are there other addresses in use?