Feds suspect ransom negotiator ran ShinyHunters extortion sitekrebsonsecurity.com
The quality of offensive tooling has somewhat improved during that period.
So why have government employees and contractors been so lazy and incompetent as to not improve defenses by a similar margin?
─ 16 more ─
+1, in this case, the hackers exploited a CVE in PeopleSoft that had a published patch. The contractors just didn't apply the patch. https://www.reuters.com/technology/accenture-contractor-remo...
If they're incompetent and lazy as you say then probably because they couldn't...
The vast majority of the competent people got DOGE’d. CISA lost like 40% of their staff including much of their red team specialty. 18F was completely eliminated (“Deleted” as Musk put it). If some specialist in the FBI who could have helped prevent the hack happened to have been assigned to work on the Classified Docs case, they were also fired because the most corrupt, incompetent group of morons is running things in DC for the next few years.
─ 10 more ─
One of the most spectacular pieces of self-own for the current administration. Restructuring/deleting the directorate for biodefense during the previous administration (of the same color) would be up there.
─ 5 more ─
I can see quite a few not-so-good reasons why they wanted to weaken the cybersecurity capability of the federal government.
It's not a self-own if they aren't the ones why have to deal with the consequences.
Do you think Donnie loses a microsecond of sleep over this?
─ 1 more ─
Touche. People who voted owned themselves.
...then the next predictable stage in the starve the beast cycle: "Why does CISA even need to exist? When was the last time you heard them do anything useful at all? Might as well shut them down and use a contractor in the private sector who knows how to get shit done and save taxpayer money on pensions."
($400 million no-bid contract goes to Oracle paying 5x as much per person, misses deadline for every key milestone, after one more $200 million extension claims government terms were impossible to meet and never delivers anything useful)
─ 1 more ─
Corruption is just entropy too
>18F was completely eliminated
18F -> https://ndstudio.gov
As seen credited on recent publications like real realfood.gov.
─ 3 more ─
Yes, there’s some new design studio that’s replaced the design aspect of 18F. Doesn’t change the fact that 18F was eliminated - https://www.nextgov.com/people/2025/03/gsa-eliminates-18f/40...
(Ill note that this design studio is being led by newly proud white nationalist Joe gebbia who apparently blames illegal aliens and their ‘anchor babies’ for high housing costs apparently while unironically forgetting he cofounded airbnb: https://substackcdn.com/image/fetch/$s_!VCGY!,w_1272,c_limit... - I mean look at these posts back to back, I wonder why they’re unable to recruit anyone: https://substackcdn.com/image/fetch/$s_!ArmA!,w_1272,c_limit...)
─ 2 more ─
Anything closer in spirit to 18F that hackers can aspire to work within?
─ 1 more ─
Not under this administration.. probably the closest is contributing to open source alternatives to services that were killed (like the IRS free tax filing that 18F helped to build and which was subsequently DOGE’d).
Government service pays far less than the private sector, particularly for software engineers. If you’re paying 2nd decile prices, you’re going to get 2nd decile performance.
─ 2 more ─
People can do things out of conviction you know.
Although I personally wouldn't lift a finger for the corrupt Christ clowns that run America these days.
This is the main reason imo. The people who worked for places like the NSA got plucked up by the private sector who paid them much more.
In one of Sean Carroll's AMA's, he once said something along the lines of "entropy favors the attacker over the defender."
That really stuck with me. My internal thought was "it's easier to kick over a sand castle than to build one." It seems to ring true for infosec, societal structures, and kinetic cases. Is this just a base truth?
─ 32 more ─
Yes, I've worded this as 'the asymmetry between creation and destruction'. Any idiot can destroy a piece of glass, it takes a whole raft of experts to make a pane and then some more to properly mount it.
─ 4 more ─
Per the IRA after an unsuccessful attempt to assassinate Thatcher, "Today we were unlucky, but remember we have only to be lucky once, you will have to be lucky always."
─ 3 more ─
IRA was unsuccessful in case of Thatcher, but was successful in case of Lord Mountbatten.
https://en.wikipedia.org/wiki/Lord_Mountbatten
I see The Troubles, as a civil war in UK.
─ 2 more ─
>I see The Troubles, as a civil war in UK.
So you're starting this all over again eh?
─ 1 more ─
I hope The Troubles will never again repeat.
I think it bears mentioning that like sand castles, software engineering has approximately zero building codes.
Try kicking over a building sometime. (Or don't - you'll stub your toe).
─ 10 more ─
Well, I don't want to get on the capital E - engineering tangent regarding software. But yeah, agreed on that. In most cases, we have been vibe engineering software this whole time.
Tangent aside, entropy favors the attacker even in the case of a building that has PE stamps on the plans and passes all codes at time of construction. Just leave it alone for a while with no maintenance, it will fall. Or, hire one man to correctly place charges. Far less work than what it took to build it.
edit: I want to make clear that what amazes me is how hard we fight entropy. We have built fragile societies, fragile technologies, we ourselves are fragile. And yet, humans are generally pretty cool and choose not to destroy all of these things, though we do have a few assholes amongst us.
─ 2 more ─
That's kind of the definition of life tho, a system that fights, or "exports" entropy. Built in to our very code. Even the sand castle kickers are doing it for many years just just to be able get to the point to kick.
"Software architecture" and engineering quality overall has had questionable quality at best. I don't see how vibe coding big new systems will make it better. I predict vibe coding will make for an even more golden age of hacking and a large increase in ransomware and breaking into systems. Today's giant hodgepodge of glued together software products could actually be better than vibing up something new.
I'd also expect the offensive side of hacking into systems will greatly benefit from LLMs finding an almost endless series of new vulnerabilities in even crappier llm software. I'm just so cynical.
“It’s easy to destroy a building than to build one” is still true, building codes or not.
In the physical sense, entropy favors the attacker because destroying something is just helping it along the path it wants to take. Everything wants to turn into dust, all the time. It takes energy to prevent it from happening. The attacker can use significantly less energy to get it moving.
Consider the energy requirements to construct a skyscraper compared to the energy requirements to demolish one.
─ 1 more ─
With our current technology, that's true, but there were hundreds of years where fortifications were pretty well impregnable showing that human technological capacity is bounded well before the laws of entropy come into play.
I mean for just the EU you have:
Digital Operational Resilience Act (DORA) and Cyber Resilience Act (CRA) which enforce mandatory governance and processes like resilience testing and cybersecurity lifecycle requirements.
GDPR & Data Protection frameworks which requires architecture to support CRUD operations on all PII, data minimization, customer-managed encryption architectures and so forth.
...and the anti-vibe code framework aka the EU AI Act, which requires human oversight and data quality controls.
This is completely aside from any industry specific engineering codes like in Finance where you have to adhere to things like ISO 20022 or iXBRL/ESEF standards, user accessibility mandates, and PCI Compliance mandates for things like Security Architecture over and above the CRA.
buildings may be quite hard to destroy, but the relevant question is whether it is proportionally harder to build one.
required codes and standards may raise one (difficulty of removal) or both (difficulty of removal + difficulty of construction) in varying proportion.
Indeed, except when you get into the critical software realm. Firmware for pacemakers, avionics etc. There are respective ISO's/regulations and enforcement bodies.
I wonder if that ever expands to traditional software when the stakes and blast radius increase significantly with time.
The tools to "knock over" a software system are easy to download and come by, but do require some skill.
On the other hand, "You wouldn't download a wrecking ball?"
>In one of Sean Carroll's AMA's, he once said something along the lines of "entropy favors the attacker over the defender."
Eh, kinda. The defenders have the advantage of playing on the home turf. They know their infrastructure, can have sensors and traps everywhere. The bad guys are stumbling in the dark. They have no idea what's real and what's a honeypot, what signals you're watching, etc.
The problem is that almost no one takes this advantage seriously. If you're not paying attention to your infra, yeah, you're gonna get owned.
─ 4 more ─
Yeah but you know there trade offs like free society, freedom of movement, privacy and stuff that you need to sacrifice to take advantage of home turf. And you need to do this everywhere. Attacker can pick his targets on his own schedule, you need to defend always.
─ 2 more ─
It just goes to show how pro-peace and stability humans are in general. It's so easy to cause death and destruction, and we most often do not choose to do that. While maybe peak_local_max_asshole = true, we have certainly been progressing in that direction, haven't we?
─ 1 more ─
or... you take advantage of the imbalance and atack first :) /j
>They know their infrastructure, can have sensors and traps everywhere.
They can have, but they’re sufficiently tied up with other corporate busy work that they don’t.
WP was designed around the idea that it should be easier to improve than deteriorate.
It is not a base truth. It is just that complete negligence is currently standard, legal, and expected in most industries. Kind of like before basic sanitation was legally mandated at hospitals preventable deaths dramatically higher.
I have designed and audited systems for dozens of orgs that protect hundreds of billions in value and regular transaction volume. HSMs, remote attestation, quorum controlled servers with custom and fully audited operating systems, and in some cases a geodistributed network of underground bank vaults, NSA tempest spec zero emissions chambers, and security down to the laws of physics.
Security can be assured with high confidence for the right price, but very few are willing to pay for it and fewer still experienced enough to offer it. 15-200k a week is common depending on reputation, but I know at least one that claims to bill 1m/w.
Personally I do not believe hoarding effective security tactics for private audiences is ethical, and thus I insist any security work and research resulting from my work for employers, clients, and my own companies must all be freely licensed open source. No exceptions for any amount of money.
Security will be normalized when it as open, cheap, and too easy to justify not doing.
Shameless plug, this is why I co-founded Caution.
─ 4 more ─
>It is not a base truth.
When you operate in an environment where every "good boy" can be wiped by a single "oh shit", statistics are against you. That is a base truth. The failure can rest on negligence but negligence isn't a necessary component for failure. For attackers their failures are wiped by a single success, for defenders their successes are wiped by a single failure.
In a different life I worked on designing and implementing similar systems to the ones you described, except with even more money going through them. They can can still be hacked, at incredible expense. And the hackers could even make a huge profit with the treasure trove they have access to. But getting away with it is orders of magnitude more difficult than the hack. The money involved to make the hack profitable is impossible to hide on the world stage. It takes a lot of political capital and military to be able to steal billions+++ and get away with it (nation state attackers, not just a group of hackers). So hackers go for lower risk jobs where the payout can even be similar just because of the lower cost to succeed.
─ 3 more ─
Unless of course you can walk in through the front door and make off with the loot...
https://www.washingtonpost.com/politics/2026/03/10/social-se...
─ 1 more ─
That's a sad and funny story, DOGE is the gift that keeps on giving in that regard (hail Musk, I guess). They are a very special group, the embodiment of carelessness and callousness, led by someone who picked them in his image. But I'm not sure what it tells us about the greater world where regardless of intention and execution the statistics are not on your side when someone is motivated to attack or destroy your things.
Yeah no, it is literally negligence and ignorance. Most production servers from startups to fortune 500s are maintained by people who have never compiled a linux kernel in their lives, let alone hardened one. They install giant monolothic codebases in a docker container in Ubuntu in prod and cross their fingers, and give their team god SSH access with expected results.
When I interview production engineers I expect them to know Linux down to the system calls. 9/10 fail, including the ones with decades of paper experience who are mostly coming from major companies. Of those that pass, I find out with little surprise, almost all use Linux as a daily driver, and have backgrounds in projects like buildroot, gentoo, and yocto. Most of the 9/10 that fail are full time MacOS users, so they never stood a chance to develop the required low level Linux security skillsets which are hard won from constant immersion and usually deep involvement in the community.
If you configure a system properly, with a purpose built kernel and OS for the job with hypervisor sandboxed remotely attestable, minimal, and provably correct constant time workloads the only way it is getting compromised is with a novel CPU flaw or hypervisor escape. Vulns of that class are VERY valuable, very rare, and blackhats will not waste them casually. If an attacker does not stand to make tens of millions, they will not risk exposing such a vuln. If that kind of value IS on the table, then you need to hire 3+ engineers that specialize in airgapped computing and hardware security modules. Factor in a 4-5m/y+ budget just for a small highly skilled security team. Most companies cannot or will not stomach that kind of cost, so they hire anyone willing to work for a typical engineer salary with a macbook who pinky swears they can run debian in production with high security even though literally no one alive can do that.
I think its generally true. attackers have to get it right only once, where as defenders have to get it right every single time.
Yes, but I think that asymmetry manifests itself in the opposite direction too:
It's much harder to have perfect opsec and never be caught for the wrongdoing. The other side only needs patience.
Doesn’t entropy also lead to more weak targets, therefore the secure defensive target is less appealing?
The whole “you don’t have to outswim the shark, just the guy next to you.”
Is this true in the digital realm though? Constructing an exploit chain is not as easy as knocking over a sandcastle and can be even more complex than the software it is attacking.
edit to the downvoters: is it easier to exploit software than to create exploitable software?
The universe is a swirling mess of chaos, when you try to create something static and keep it in that state you are going against the rules
>In late September, ShinyHunters hacked the FBI recruitment website fbijobs.gov
Working in the IR space I’ve had a lot of opportunities to work with negotiators before. Most of them are extremely professional and worth their weight in gold for what they provide to their clients.
Ridiculous that scumbags like this are tarnishing that space.
Can you shed a light on what this process looks like? Are negotiations are alike or completely unique? What does it boil down to..?
Thanks!
The book "Never split the difference" is a great read on hostage negotiations.
─ 5 more ─
I do (half) remember reading that book! I actually meant to ask (in my question above) whether that book is actually "accurate"/representative of malware negotiations.
─ 4 more ─
ah. No idea.
─ 3 more ─
So the book "Never split the difference" might not be a great read on hostage negotiations?
─ 2 more ─
You made an account just to verify this?
─ 1 more ─
Welcome to the Internet!
No honestly, most of the time it’s very formulaic. You can usually tell how it’s going to go once you know who has your data.
For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay.
Other actors though have a reputation to uphold to get paid and they know it.
An example of the process is something like:
1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings.
2. Negotiators notified.
3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”.
─ 3 more ─
do you capitalize tor too?
What is COM?
─ 1 more ─
A group of especially egregious, threat actors.
Nothing is yet proven and other articles have painted this arrest as shocking.
based on history, expect more ridiculous scumbags in the future:
https://www.bleepingcomputer.com/news/security/ransomware-re...
https://complexdiscovery.com/a-48-month-federal-benchmark-re...
Ransom negotiators are all scumbags. Their actions perpetuate further criminality and place others at greater risk. Paying a ransom should always be a criminal offense, even if not paying means that people die and businesses are destroyed.
Huh? You'd rather criminals make a little less money than hospitals getting taken offline and people dying? Or power utilities. Very cringe to care more about how much pieces of paper a criminal has than your community member's lives. I definately do not want you as my neighbor.
─ 20 more ─
Reading their comment strongly, as the guidelines suggest, it seems they want criminals to make $0 so they stop doing that. Is it not equally "cringe" to say society can't put up with some discomfort so assholes don't get free vacations and nice toys. It's a disguised trolley problem, and there's no agreed upon answer for that one either.
https://neal.fun/absurd-trolley-problems/
We all gotta do what we can to get through the day, but you can't live next to someone who has the same challenge but a different answer to some trolly problem? Is your future world just a bunch of closed communities where outsiders and ideas and their differ skin color and economic background aren't welcome?
─ 10 more ─
Yeah but you're proposing a trolley problem where we kill the five people on the other track so the single guy on the track can't have nice clothes lol.
Or we pay the criminals, not let innocent people die because turbo nerds care about rewarding cyber criminals who will exist no matter what.
So I guess we should just let people die though, atleast the feds will have jobs and be able to go on vacation and not those damn criminals!! Although I fail to see much difference between US law enforcement and cyber criminals, both of their existence relies on the threat of violance and the extortion of the public with that violence.
Also I'm pretty sure the FBI gave birth to the shiny hunters if you look into it for more than 10 minutes. Its a bunch of kids they basically have chosen not to punish at various points in their criminal evolution. Its almost like they need these phenomenons to exist.
My ideal society is one without crooked cops, but alas I dont think that's likely either so in the meantime, until we can find a solution to that problem we probably shouldnt punish the innocent patients of hospitals.
It seems to me that money and the status of criminals is more important to you than human life, so we should probably deal with whatever brain worm has infected you too.
─ 3 more ─
So you should knows that there is no convincing evidence that brain worms cause specific cultural beliefs, religions, or ideologies, but in any case:
>When disagreeing, reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."
https://news.ycombinator.com/newsguidelines.html
Linked at the bottom of the page.
It's a stupid what-if scenario and there are endless variations. What if the ransomware attack doesn't kill anybody? What if the ransomware attack ends up saving a patient because the surgeon is given more time to think about a case so they don't make the mistake they would have? What if that hospital being shut down means a patient was sent to a different ER where the attending on duty was able to save the victim because of something unique to them from their past.
What if the cybercriminals doesn't use the money to buy nicer clothes but instead uses it to go on vacation but gets themselves killed? Are we supposed to be sad someone who inflicted pain on others died? Is all life sacred or not? Or is some more sacred than others? What if they use it to fund terrorists that end up killing lots of people, possibly even someone you know? Was it still worth it then? What if the criminals use to bomb churches and subways? What if one of the cyber criminals uses it to buy people? or kill homeless people for fun?
Another direction we can go is, I forget where this is from off the top of my head, but a human life is calculated to be worth about $10 million. So then if we're going to do another different point of view and put this into economics, we should figure out how many people shutting down the hospital will kill and see how much the group is charging and compare the two, right?
Talk is cheap and it's easy to spend other people's money or dismiss it as bits of paper. How much of your money are willing to give the criminals for the hospital to stay open? How many nights are you willing to go hungry and stay in so that the criminals can walk free? Because if it's arbitrary money that's not yours, of course it's easy to give away. It's based on a facile understanding of the world though.
If nothing is more important than saving human lives, what are you doing on HN, not curing cancer right now? People are dying!
─ 2 more ─
No offense, Im just going to end this conversation because you dont really seem capable of thinking deeply about a topic like this. I really wish I didnt have to share a world with people like you that think the value of a human life can be reduced to numbers on a calculator.
Not touching on the rest of this back and forth but your probably wrong about parasites not affecting beliefs and critical thinking For instance toxoplasmosis
https://asm.org/articles/2026/may/toxoplasma-made-me-do-it-h...
>it seems they want criminals to make $0 so they stop doing that
And yet arguably the criminals are unwittingly performing a useful public service we might describe as involuntary pentesting with a financial penalty on failure. The ethical way to get rid of the criminals in this scenario is to institute competent regulation (ie not mindless box ticking) and enforcement.
Hypothetically we are all arguably better off with a ransomware attack if the alternative is a cyberattack by a geopolitical adversary at a later date.
─ 5 more ─
How is that a useful service? This is only useful because the criminals exist and are doing it. Are killers providing a useful service because people then use protection so they don't get killed?
Or perhaps it is useful by hardening systems in case you enter a war with another country, but presumably the other country has the same problems so it's a zero sum game.
─ 4 more ─
Killers must be a useful service, because the FBI, CIA and Department of War are all relying in their services.
"By any means" is a current movie with the FBI case.
While "useful service" may be generous wording, in my own experience, when given the option between "pentesting" and "ransom+patching", most corporations would prefer the third, cheaper option: do nothing.
─ 2 more ─
But what would be the point of pentesting if there were no hackers?
─ 1 more ─
Petty criminals are not the only black hat hackers that exist. An immediate monetary payout is not the only motivation for breaking into the computer system of a service that's essential to society.
If we're unable to constructively reform the regulator a genuine (though politically untenable) alternative would be to remove criminal penalties for intrusion and publication of private data provided that no physical damage was done and no disruption to daily operations occurred. Effectively legalizing blackmail of data breach and cryptominers.
Yes, I would absolutely rather have that. Preventing criminals from receiving additional money prevents them from having the resources to attack others in the future. Unlike you, I actually care about my community and think deeply about the consequences.
─ 4 more ─
Alternately they may not believe starving out the criminals will actually work and so foresee different consequences. Like when Google penalized SEO, and so spammers used their networks for extortion instead of spam. Similarly if we killed ransomware, the machinery built to conduct these attacks would not just lie fallow. It's capital that will continue to be leveraged to generate returns. We may not like the next business model they come up with.
It's not a contest, we all can care and think deeply and still come to different conclusions.
─ 2 more ─
I am not claiming there is magic "fix it" button, but yes, killing ransomware would be a good thing.
Deliberately letting ransomware go on, because you are scared that evil people may do something worse is quite absurd.
Deliberate welfare for criminals is in fact bad.
─ 1 more ─
This is a very narrow framing, and that is what I am trying to get at. Obviously it would be absurd to deliberately provide welfare to criminal enterprises. But our adversaries get a vote in what happens. There is a level of risk at which you are forced to pay the ransom.
If we don't get trapped in this false binary we might consider other options. I think the takeaway from my comment should be, if you want to make it illegal to pay a ransom to these groups, then you will also need to dismantle their infrastructure and organization. Otherwise you're just putting the ball in their court and hoping they'll fumble it. It's not that we're "scared," it's that that isn't a strategy.
Even if it was a loved one of yours who was in danger? You would rather your children, parents, or spouse die, instead of paying the kidnappers a ransom?
It sounds like you don’t understand the problem very well. Forgive me if that’s an incorrect interpretation.
One way to prevent this type of crime is to ensure that it is never profitable. The downside is that there will be losses until the message is thoroughly communicated.
─ 3 more ─
And a new method is invented in about 24 hrs.
Who cares if criminals have nice things, Id rather innocent people dont die. Most criminals tend to find ways to ruin their own lives at some point anyways. Peoples lives > pieces of paper.
Its like you're proposing a trolly problem where you choose the 5 people on a track to die because you don't want the single guy on a track to have nice clothes.
─ 2 more ─
"Criminals having vacations and nice things" wasn't a great framing, "criminal enterprises continue to have revenue to reinvest in more crimes" is the better one.
>Id rather innocent people dont die
that is one of reasons why ransomware should be being eliminated
“Well then it’s a good thing I wasn’t paying a ransom but instead a pentesting fee!”
Even if it's a scummy business model, there's a line between being a negotiator after the fact recruited by the victim and an accessory to the crime.
─ 2 more ─
This is the argument slave traders used.
─ 1 more ─
I would say I'm excited to know how you imagine that parallel, but I'm afraid you'd miss the sarcasm.
Very cringe of you to automatically believe what the FBI tells you, especially when they're embarassed and trying to save face.
Especially considering who's in charge of the FBI at the moment.
Breaking Bad vibes here. "You don't want a ransom negociator, you want a ransom negociator!"
Better than some random negotiator.
You can have $1,000,000 in unmarked bills as requested. Or you can have whatever is in the mystery box!
─ 4 more ─
And remember to switch doors if Monty offers it!
─ 1 more ─
What if I wanted a goat?
The box, the box, the box!
"oh no, my wife's head!", he says, calmly.
Yes, indeed! Can you imagine how slow /dev/random would be if every random number would have to be negotiated first?
You want Ransom: https://www.youtube.com/watch?v=fLYhYRtVlYQ
Even before the current administration, federal law enforcement's leaks of suspects, especially in high-profile crimes, have been highly unreliable and have ruined lives. See Wen Ho Lee, Richard Jewell, etc.
What kind of incentive structure do most ransomware negotiation firms use that would actually cause them to benefit from coordination with the ransomware groups, as happened in this case? Do ransomware negotiators get paid more if they negotiate a lower price?
Probably a percentage cut because they’re also the ones pressuring the victim to pay.
I believe the incentive is that they help establish a reputable connection between the ransomware group and the victim.
From what I have read in the past is that victims have no reason to trust ransomware groups and pay because what is stopping them from just demanding more money or hacking the company again. So from what I read is that ransomware companies depend on building a trust that after payment you will get your data back and he left alone.
So I believe that by working with a ransomware negotiator, a company that assumingly is a legitimate lawful business, the victim and hacker both benefit with the trust that this middleman is legit and the working history established has shown that those who pay do end up getting their data back.
TLDR: why believe a hacker that if you pay they will actually leave you alone. But a legitimate middleman with a history of dealing with these things and a proven track record can establish immediately confidence that paying will result in data recovery. So it's not about a lower price but rather a confidence you won't get screwed after paying.
Should be illegal in the same way that getting a lawyer to communicate threats is illegal. I'm surprised it's legal to pay ransoms at all.
─ 1 more ─
Depending on where you are, it is arguably illegal (money laundering, dealing with proceeds of crime, maybe contravening sanctions depending on the gang) but I’m not aware of this being tested.
If I understand your question correctly, it's actually the opposite:
>some firms charge a flat retainer fee, while those that specialize in helping companies negotiate a ransom payment tend to charge a percentage of the total ransom amount paid.
Having a good relation with the ransomware group means that the group can ask for more knowing that the negotiation firm won't object too much and that the ransomware firm stands to gain more. Other than the victim, everybody wins.
Oldest trick in the book. Organise the crime, then go to the victim with the solution.
"Heard you got robbed"
–Chris Rock
>Dutch police reportedly used flash-bang grenades in an effort to stun and apprehend Van der Stap as he was logged in to various online accounts.
Holy moly, this is the first time I hear about this tactic. I remember more benign distraction tactics used previously with Ross Ulbricht and the other guy in Thailand running another darknet marketplace.
And flash-bang grenades are not without health risks. They can cause permanent hearing damage, and earlier this month a teenager lost their hand to a stun granade in protests near Paris (conflicting accounts, either an unlucky direct hit or he picked it up to throw it back). I really don't see how a flash-bang grenade is justified against a person sitting in front of a computer, doing non-violent crimes. Non-violent options exist, as was successfully demonstrated in the cases you mention
Giving the police better non-lethal weapons is always easy to justify by citing all the cases where they can replace more lethal weapons or directly lead to better outcomes. But given a couple years time they always end up being used for more and more mundane situations where the harm clearly outweighs any gain. Same story with pepper spray, tear gas grenades, tasers, even anti-riot water cannons.
>a teenager lost their hand to a stun granade in protests near Paris
Yes, because he was dumb enough to pick it up with his hand
─ 22 more ─
Yes, teenagers tend to be pretty stupid but... do you think if a grenade was thrown at you that you'd react rationally?
─ 6 more ─
Yes, I think I would react pretty rationally- run away or duck and cover. Zero chance I pick it up. And I was a super stupid and irrational teen. (And am still rather stupid and irrational)
─ 4 more ─
When I was 14 I used to think I could shoot a kamehameha if I tried hard enough. Even then I would have made fun of people thinking they'd know what to do when a fucking grenade was thrown at them.
─ 3 more ─
Are you still 14? When I was 14 there were situations where tear gas grenades were thrown in the city where I went to school (Amsterdam) in the context of squatter riots. I did my best to avoid these, never felt the need to play edge lord and join the mob, don a keffiyeh and shout inane phrases. I did do plenty of 'stupid' things but picking up live grenades was just too damn stupid. The Darwin Award was still decades away but had I known the term I'd have applied it to those who do such things whether they're 14 or 41. If you really need to get rid of the thing you at most kick it away - also risky - but best just to move away from it until it detonates. I knew that at 14 and I still know it. Didn't you? Don't you?
─ 2 more ─
This conversation isn't about tear gas grenades.
─ 1 more ─
The conversation is about rioters and those who confront them. Whether it is tear gas grenades, flashbangs, smoke grenades, stun grenades or any other non-lethal weapon is besides the point. It is about suffering the consequences when you pick up a live piece of ordnance.
and on top of that, this is what a rational reaction gets them
https://bsky.app/profile/thenewarab.bsky.social/post/3myb2ze...
There are not a lot of situations where you are legally allowed to throw explosives at someone, then say everything is fine because they would have been fine if they just hadn't picked them up
─ 10 more ─
For the life of me I can't get their comment out of my head. It's just so ridiculous that I can't figure out what their point even is.
─ 7 more ─
I think their point is that one should never pick up a flash bang grenade. Especially one that has been fired at you and is about to explode.
I think it’s a pretty good life lesson to follow. Both not to be someone in a position to fire them and to not be throwing them back.
Seems like one of many “don’t do stupid high risk things” rules like avoiding base jumping or Johannesburg at night.
─ 6 more ─
I think you, also, are misunderstanding why their comment is such a ridiculous thing to say.
─ 2 more ─
I certainly may be. It doesn't seem ridiculous to me. I've read through all the follow on comments and aside from people saying it's ridiculous, I don't get why others think it so.
─ 1 more ─
So you're just that much of a badass?
Remind me to not be anywhere near you in a crowd. It'd piss me off to no end if the last thing I saw and had to waste my last seconds of life thinking about was "They're just going to stare until it blows u....."
If you have something that looks like it explodes land next to you in a crowd, and you do nothing simply because you think you deserve it (not talking about freezing up or just ignorant to what it is), you're a morally bankrupt coward that also deserves a share of the blame for harm done to anyone around you.
─ 2 more ─
I certainly wouldn't stare at it until it exploded. I would run away as fast as I could.
It's odd that you think the exclusive options are 1) do nothing; 2) pick up and throw away
Of course, it's extremely unlikely I'd be in any crowd with you. Because we are likely very far apart geographically. And I work to avoid any crowds that may involve flash bang grenades thrown into them. So far, I have an excellent success ratio and expect it to stay steady.
I think kids are seeing videos of people throwing these and, of course, only the successful videos make it to their feeds. As the unsuccessful ones are bloody enough to get filtered out.
Your comment seems a bit hostile and ill willed as there are many who become shell shocked in these situations and freeze up. This doesn't make it "morally bankrupt." It just makes them human.
Good luck with your moral high horse and being so superior. I hope you retain all your digits.
─ 1 more ─
"I think kids are seeing videos of people throwing these and, of course, only the successful videos make it to their feeds."
What makes you think this? This is such a fucking absurd thing to say.
protip: don't do things that make people want to throw grenades at you
There is one though: when you're throwing it as part of an organisation which has the official monopoly on violence - the police - in the context of controlling others who are violating that monopoly. Police are allowed to use violent means to suppress riots and that includes the use of flashbangs, stun grenades, tear gas and other similarly dangerous items. The boy who picked up the flashbang/grenade (unclear which one it was) was part of a group of rioters and as such had put himself in a position where he could expect to be exposed to police violence. Had he not been rioting he'd still have his hand but alas, he was, he did pick it up and his hand is gone.
If you have children tell them not to participate in these riots - which seem to be either organised by or used by both Melenchon's communist party as well as several islamic groups to achieve their goals - and, if he ever gets embroiled in one, make his way out as quickly as he can. Tell them not to be like Lenin's useful idiots, henchmen for the revolution who are discarded as soon as the goal is achieved. To those who think this means they should just accept any and all governmental abuse and neglect, think again. There are many ways to act against such abuse and neglect without feeding the communist/islamofascist/${extremist} beasts.
Call of Duty lied to him.
>because he was dumb enough to pick it up with his hand
Indeed. And what? People do dumb things, that's a given.
─ 1 more ─
And this: teach your children to be diligent in what dumb things they do. Picking up live grenades is not just dumb but out of the gene pool dumb.
Smokey Bear said don't play with matches, I hope Daddy Williamdclt will/did tell his children not to play with live grenades.
While it is generally not the brightest move, they might have been thinking it was a tear gas grenade, which are not uncommonly picked up and thrown back at the cops (using thick gloves or a rag). This is because tear gas canisters get hot instead of exploding. I'm not sure I'd be able to tell the difference in under a second and maybe the tear gas reaction was just slow-starting on that one.
Let's not forget when police lobbed a flash grenade that landed in a baby's crib (WARNING: POSSIBLY DISTURBING PHOTOS):
https://www.nbcnews.com/news/us-news/ex-georgia-deputy-acqui...
─ 1 more ─
That one gets my blood boiling every time.
>I really don't see how a flash-bang grenade is justified against a person sitting in front of a computer, doing non-violent crimes.
People who pretend that nonviolent crimes are some kind of special thing always confuse and annoy me. Coups can be nonviolent, should we avoid flashbangs against a group trying to undermine a democracy? The seriousness of the crime is what should matter, not whether a threat of bodily harm was involved. Are you destroying someone’s life is what matters.
We are talking about an organization ruining people’s livelihoods. Dozens and dozens of lives wrecked. Millions stolen.
Yes, less-lethal force is very obviously justified.
a teenage hacker huh
Wait so people take "Ransomware Negotiation Firms" as a legitimate business? Isn't it incredibly plainly in site that they are all in on it? Seriously WTF why have they been allowed to exist and operate when they are de facto collaborators?
The OPM breach was 11 years ago and apparently the incompetence still reigns.