Feds suspect ransom negotiator ran ShinyHunters extortion site
krebsonsecurity.com
krebsonsecurity.com
Holy moly, this is the first time I hear about this tactic. I remember more benign distraction tactics used previously with Ross Ulbricht and the other guy in Thailand running another darknet marketplace.
Giving the police better non-lethal weapons is always easy to justify by citing all the cases where they can replace more lethal weapons or directly lead to better outcomes. But given a couple years time they always end up being used for more and more mundane situations where the harm clearly outweighs any gain. Same story with pepper spray, tear gas grenades, tasers, even anti-riot water cannons.
Yes, because he was dumb enough to pick it up with his hand
https://bsky.app/profile/thenewarab.bsky.social/post/3myb2ze...
I think it’s a pretty good life lesson to follow. Both not to be someone in a position to fire them and to not be throwing them back.
Seems like one of many “don’t do stupid high risk things” rules like avoiding base jumping or Johannesburg at night.
If you have something that looks like it explodes land next to you in a crowd, and you do nothing simply because you think you deserve it (not talking about freezing up or just ignorant to what it is), you're a morally bankrupt coward that also deserves a share of the blame for harm done to anyone around you.
It's odd that you think the exclusive options are 1) do nothing; 2) pick up and throw away
Of course, it's extremely unlikely I'd be in any crowd with you. Because we are likely very far apart geographically. And I work to avoid any crowds that may involve flash bang grenades thrown into them. So far, I have an excellent success ratio and expect it to stay steady.
I think kids are seeing videos of people throwing these and, of course, only the successful videos make it to their feeds. As the unsuccessful ones are bloody enough to get filtered out.
Your comment seems a bit hostile and ill willed as there are many who become shell shocked in these situations and freeze up. This doesn't make it "morally bankrupt." It just makes them human.
Good luck with your moral high horse and being so superior. I hope you retain all your digits.
What makes you think this? This is such a fucking absurd thing to say.
If you have children tell them not to participate in these riots - which seem to be either organised by or used by both Melenchon's communist party as well as several islamic groups to achieve their goals - and, if he ever gets embroiled in one, make his way out as quickly as he can. Tell them not to be like Lenin's useful idiots, henchmen for the revolution who are discarded as soon as the goal is achieved. To those who think this means they should just accept any and all governmental abuse and neglect, think again. There are many ways to act against such abuse and neglect without feeding the communist/islamofascist/${extremist} beasts.
Indeed. And what? People do dumb things, that's a given.
Smokey Bear said don't play with matches, I hope Daddy Williamdclt will/did tell his children not to play with live grenades.
https://www.nbcnews.com/news/us-news/ex-georgia-deputy-acqui...
People who pretend that nonviolent crimes are some kind of special thing always confuse and annoy me. Coups can be nonviolent, should we avoid flashbangs against a group trying to undermine a democracy? The seriousness of the crime is what should matter, not whether a threat of bodily harm was involved. Are you destroying someone’s life is what matters.
We are talking about an organization ruining people’s livelihoods. Dozens and dozens of lives wrecked. Millions stolen.
Yes, less-lethal force is very obviously justified.
The OPM breach was 11 years ago and apparently the incompetence still reigns.
Do you think Donnie loses a microsecond of sleep over this?
($400 million no-bid contract goes to Oracle paying 5x as much per person, misses deadline for every key milestone, after one more $200 million extension claims government terms were impossible to meet and never delivers anything useful)
18F -> https://ndstudio.gov
As seen credited on recent publications like real realfood.gov.
(Ill note that this design studio is being led by newly proud white nationalist Joe gebbia who apparently blames illegal aliens and their ‘anchor babies’ for high housing costs apparently while unironically forgetting he cofounded airbnb: https://substackcdn.com/image/fetch/$s_!VCGY!,w_1272,c_limit... - I mean look at these posts back to back, I wonder why they’re unable to recruit anyone: https://substackcdn.com/image/fetch/$s_!ArmA!,w_1272,c_limit...)
Although I personally wouldn't lift a finger for the corrupt Christ clowns that run America these days.
That really stuck with me. My internal thought was "it's easier to kick over a sand castle than to build one." It seems to ring true for infosec, societal structures, and kinetic cases. Is this just a base truth?
https://en.wikipedia.org/wiki/Lord_Mountbatten
I see The Troubles, as a civil war in UK.
So you're starting this all over again eh?
Try kicking over a building sometime. (Or don't - you'll stub your toe).
Tangent aside, entropy favors the attacker even in the case of a building that has PE stamps on the plans and passes all codes at time of construction. Just leave it alone for a while with no maintenance, it will fall. Or, hire one man to correctly place charges. Far less work than what it took to build it.
edit: I want to make clear that what amazes me is how hard we fight entropy. We have built fragile societies, fragile technologies, we ourselves are fragile. And yet, humans are generally pretty cool and choose not to destroy all of these things, though we do have a few assholes amongst us.
I'd also expect the offensive side of hacking into systems will greatly benefit from LLMs finding an almost endless series of new vulnerabilities in even crappier llm software. I'm just so cynical.
Consider the energy requirements to construct a skyscraper compared to the energy requirements to demolish one.
Digital Operational Resilience Act (DORA) and Cyber Resilience Act (CRA) which enforce mandatory governance and processes like resilience testing and cybersecurity lifecycle requirements.
GDPR & Data Protection frameworks which requires architecture to support CRUD operations on all PII, data minimization, customer-managed encryption architectures and so forth.
...and the anti-vibe code framework aka the EU AI Act, which requires human oversight and data quality controls.
This is completely aside from any industry specific engineering codes like in Finance where you have to adhere to things like ISO 20022 or iXBRL/ESEF standards, user accessibility mandates, and PCI Compliance mandates for things like Security Architecture over and above the CRA.
required codes and standards may raise one (difficulty of removal) or both (difficulty of removal + difficulty of construction) in varying proportion.
I wonder if that ever expands to traditional software when the stakes and blast radius increase significantly with time.
On the other hand, "You wouldn't download a wrecking ball?"
Eh, kinda. The defenders have the advantage of playing on the home turf. They know their infrastructure, can have sensors and traps everywhere. The bad guys are stumbling in the dark. They have no idea what's real and what's a honeypot, what signals you're watching, etc.
The problem is that almost no one takes this advantage seriously. If you're not paying attention to your infra, yeah, you're gonna get owned.
They can have, but they’re sufficiently tied up with other corporate busy work that they don’t.
I have designed and audited systems for dozens of orgs that protect hundreds of billions in value and regular transaction volume. HSMs, remote attestation, quorum controlled servers with custom and fully audited operating systems, and in some cases a geodistributed network of underground bank vaults, NSA tempest spec zero emissions chambers, and security down to the laws of physics.
Security can be assured with high confidence for the right price, but very few are willing to pay for it and fewer still experienced enough to offer it. 15-200k a week is common depending on reputation, but I know at least one that claims to bill 1m/w.
Personally I do not believe hoarding effective security tactics for private audiences is ethical, and thus I insist any security work and research resulting from my work for employers, clients, and my own companies must all be freely licensed open source. No exceptions for any amount of money.
Security will be normalized when it as open, cheap, and too easy to justify not doing.
Shameless plug, this is why I co-founded Caution.
When you operate in an environment where every "good boy" can be wiped by a single "oh shit", statistics are against you. That is a base truth. The failure can rest on negligence but negligence isn't a necessary component for failure. For attackers their failures are wiped by a single success, for defenders their successes are wiped by a single failure.
In a different life I worked on designing and implementing similar systems to the ones you described, except with even more money going through them. They can can still be hacked, at incredible expense. And the hackers could even make a huge profit with the treasure trove they have access to. But getting away with it is orders of magnitude more difficult than the hack. The money involved to make the hack profitable is impossible to hide on the world stage. It takes a lot of political capital and military to be able to steal billions+++ and get away with it (nation state attackers, not just a group of hackers). So hackers go for lower risk jobs where the payout can even be similar just because of the lower cost to succeed.
https://www.washingtonpost.com/politics/2026/03/10/social-se...
When I interview production engineers I expect them to know Linux down to the system calls. 9/10 fail, including the ones with decades of paper experience who are mostly coming from major companies. Of those that pass, I find out with little surprise, almost all use Linux as a daily driver, and have backgrounds in projects like buildroot, gentoo, and yocto. Most of the 9/10 that fail are full time MacOS users, so they never stood a chance to develop the required low level Linux security skillsets which are hard won from constant immersion and usually deep involvement in the community.
If you configure a system properly, with a purpose built kernel and OS for the job with hypervisor sandboxed remotely attestable, minimal, and provably correct constant time workloads the only way it is getting compromised is with a novel CPU flaw or hypervisor escape. Vulns of that class are VERY valuable, very rare, and blackhats will not waste them casually. If an attacker does not stand to make tens of millions, they will not risk exposing such a vuln. If that kind of value IS on the table, then you need to hire 3+ engineers that specialize in airgapped computing and hardware security modules. Factor in a 4-5m/y+ budget just for a small highly skilled security team. Most companies cannot or will not stomach that kind of cost, so they hire anyone willing to work for a typical engineer salary with a macbook who pinky swears they can run debian in production with high security even though literally no one alive can do that.
It's much harder to have perfect opsec and never be caught for the wrongdoing. The other side only needs patience.
The whole “you don’t have to outswim the shark, just the guy next to you.”
edit to the downvoters: is it easier to exploit software than to create exploitable software?
From what I have read in the past is that victims have no reason to trust ransomware groups and pay because what is stopping them from just demanding more money or hacking the company again. So from what I read is that ransomware companies depend on building a trust that after payment you will get your data back and he left alone.
So I believe that by working with a ransomware negotiator, a company that assumingly is a legitimate lawful business, the victim and hacker both benefit with the trust that this middleman is legit and the working history established has shown that those who pay do end up getting their data back.
TLDR: why believe a hacker that if you pay they will actually leave you alone. But a legitimate middleman with a history of dealing with these things and a proven track record can establish immediately confidence that paying will result in data recovery. So it's not about a lower price but rather a confidence you won't get screwed after paying.
> some firms charge a flat retainer fee, while those that specialize in helping companies negotiate a ransom payment tend to charge a percentage of the total ransom amount paid.
Having a good relation with the ransomware group means that the group can ask for more knowing that the negotiation firm won't object too much and that the ransomware firm stands to gain more. Other than the victim, everybody wins.
–Chris Rock
Ridiculous that scumbags like this are tarnishing that space.
Thanks!
For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay.
Other actors though have a reputation to uphold to get paid and they know it.
An example of the process is something like:
1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings.
2. Negotiators notified.
3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”.
https://www.bleepingcomputer.com/news/security/ransomware-re...
https://complexdiscovery.com/a-48-month-federal-benchmark-re...
https://neal.fun/absurd-trolley-problems/
We all gotta do what we can to get through the day, but you can't live next to someone who has the same challenge but a different answer to some trolly problem? Is your future world just a bunch of closed communities where outsiders and ideas and their differ skin color and economic background aren't welcome?
Or we pay the criminals, not let innocent people die because turbo nerds care about rewarding cyber criminals who will exist no matter what.
So I guess we should just let people die though, atleast the feds will have jobs and be able to go on vacation and not those damn criminals!! Although I fail to see much difference between US law enforcement and cyber criminals, both of their existence relies on the threat of violance and the extortion of the public with that violence.
Also I'm pretty sure the FBI gave birth to the shiny hunters if you look into it for more than 10 minutes. Its a bunch of kids they basically have chosen not to punish at various points in their criminal evolution. Its almost like they need these phenomenons to exist.
My ideal society is one without crooked cops, but alas I dont think that's likely either so in the meantime, until we can find a solution to that problem we probably shouldnt punish the innocent patients of hospitals.
It seems to me that money and the status of criminals is more important to you than human life, so we should probably deal with whatever brain worm has infected you too.
> When disagreeing, reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."
https://news.ycombinator.com/newsguidelines.html
Linked at the bottom of the page.
It's a stupid what-if scenario and there are endless variations. What if the ransomware attack doesn't kill anybody? What if the ransomware attack ends up saving a patient because the surgeon is given more time to think about a case so they don't make the mistake they would have? What if that hospital being shut down means a patient was sent to a different ER where the attending on duty was able to save the victim because of something unique to them from their past.
What if the cybercriminals doesn't use the money to buy nicer clothes but instead uses it to go on vacation but gets themselves killed? Are we supposed to be sad someone who inflicted pain on others died? Is all life sacred or not? Or is some more sacred than others? What if they use it to fund terrorists that end up killing lots of people, possibly even someone you know? Was it still worth it then? What if the criminals use to bomb churches and subways? What if one of the cyber criminals uses it to buy people? or kill homeless people for fun?
Another direction we can go is, I forget where this is from off the top of my head, but a human life is calculated to be worth about $10 million. So then if we're going to do another different point of view and put this into economics, we should figure out how many people shutting down the hospital will kill and see how much the group is charging and compare the two, right?
Talk is cheap and it's easy to spend other people's money or dismiss it as bits of paper. How much of your money are willing to give the criminals for the hospital to stay open? How many nights are you willing to go hungry and stay in so that the criminals can walk free? Because if it's arbitrary money that's not yours, of course it's easy to give away. It's based on a facile understanding of the world though.
If nothing is more important than saving human lives, what are you doing on HN, not curing cancer right now? People are dying!
https://asm.org/articles/2026/may/toxoplasma-made-me-do-it-h...
And yet arguably the criminals are unwittingly performing a useful public service we might describe as involuntary pentesting with a financial penalty on failure. The ethical way to get rid of the criminals in this scenario is to institute competent regulation (ie not mindless box ticking) and enforcement.
Hypothetically we are all arguably better off with a ransomware attack if the alternative is a cyberattack by a geopolitical adversary at a later date.
Or perhaps it is useful by hardening systems in case you enter a war with another country, but presumably the other country has the same problems so it's a zero sum game.
"By any means" is a current movie with the FBI case.
If we're unable to constructively reform the regulator a genuine (though politically untenable) alternative would be to remove criminal penalties for intrusion and publication of private data provided that no physical damage was done and no disruption to daily operations occurred. Effectively legalizing blackmail of data breach and cryptominers.
It's not a contest, we all can care and think deeply and still come to different conclusions.
Deliberately letting ransomware go on, because you are scared that evil people may do something worse is quite absurd.
Deliberate welfare for criminals is in fact bad.
If we don't get trapped in this false binary we might consider other options. I think the takeaway from my comment should be, if you want to make it illegal to pay a ransom to these groups, then you will also need to dismantle their infrastructure and organization. Otherwise you're just putting the ball in their court and hoping they'll fumble it. It's not that we're "scared," it's that that isn't a strategy.
One way to prevent this type of crime is to ensure that it is never profitable. The downside is that there will be losses until the message is thoroughly communicated.
Who cares if criminals have nice things, Id rather innocent people dont die. Most criminals tend to find ways to ruin their own lives at some point anyways. Peoples lives > pieces of paper.
Its like you're proposing a trolly problem where you choose the 5 people on a track to die because you don't want the single guy on a track to have nice clothes.
that is one of reasons why ransomware should be being eliminated