Ransomware Gang Willing to Haggle

Getting your computer or device infected with ransomware is never a fun deal, but did you ever think you could haggle with the criminal on price? Apparently, if you can communicate in Russian, you may have a shot at lowering the price.

The key to protecting yourself against ransomware is to keep current backups. This way you can format your system, reinstall the OS and then put your data back. Paying the criminal is always a bad idea. There is no guarantee they will decrypt your data nor is there any way to know if they left other malware on your device for other nefarious reasons.

Natalia Kolesova, a security researcher with Checkpoint, recently took a test system and posing as an innocent bystander, intentionally had her PC infected with a ransomware called Troldesh, which is very similar to the more popular CryptoLocker. Once it’s on your machine, it begins encrypting any files that look like they might have personal significance: photos, videos, documents, etc. Once your files are encrypted, the only way to get them back is to pay the ransom.

The initial ransom demand for Kolesova’s files was about $278. To prove they would honor the payment and decrypt all the files, the ramsomers offered to decrypt one file of her choosing. Kolesova decided to ask for additional assurances, claiming the ransom was a large amount to produce.  To Kolesova’s shock, they came back with a 15% discount offer. She later pleaded one more time and unbelievably they responded with a discount over 50%.

It is interesting that the criminals were willing to haggle, but the bottom line is the same as the opening advice. Keep your backups current and never pay the bloodsuckers a dime.