{"id":47002,"date":"2022-06-06T00:00:00","date_gmt":"2022-06-06T00:00:00","guid":{"rendered":"urn:uuid:9d89c67f-1dbd-4311-251d-755263b55541"},"modified":"2022-06-06T00:00:00","modified_gmt":"2022-06-06T00:00:00","slug":"closing-the-door-deadbolt-ransomware-locks-out-vendors-with-multitiered-extortion-scheme","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/closing-the-door-deadbolt-ransomware-locks-out-vendors-with-multitiered-extortion-scheme\/","title":{"rendered":"Closing the Door: DeadBolt Ransomware Locks Out Vendors With Multitiered Extortion Scheme"},"content":{"rendered":"

<\/p>\n

<\/div>\n

The dark blue line in the survival analysis in Figure 8 shows the date range when victims paid the ransom amount. In this analysis, the victims that do not pay the ransom amount are referred to as survivors, while those who do are referred to as terminal. This analysis allows us to better understand the science of ransomware and ransom payout prevention.<\/p>\n

We can go further and say that for about 5 to 7.5 bitcoins (roughly US$200,000 to US$300,000 as of this publishing), they would be willing to give away their methods \u2014 we are, however, only taking them for their word, which admittedly is on the charitable side. On the other hand, the charitable assumption on our end allows for this analysis. It\u2019s also possible that DeadBolt actors think that a conversion ratio of 6% (300,000 divided by 4,400,000) is substantial enough to cash out. They obviously know a lot more about payment ratios than we do, because they eventually topped out at 8%.<\/p>\n

It\u2019s also clear that they knew in advance that US$300,000 would have been a good, low-risk deal. That in turn suggests that the entire operation cost them less than US$150,000, otherwise their profit margins would be undesirable. However, it\u2019s worth noting that the fact that 92% of victims have chosen not to pay ransom is an enormous success in cybersecurity \u2014 one that we often choose to ignore; instead, we tend to focus on how much ransomware actors have earned in their attacks.<\/p>\n

Let\u2019s try to understand the economic damage that DeadBolt has caused as best as we can. Presumably, for those who paid ransom, their financial losses would have been greater than 0.03 bitcoins (roughly US$1,000 at that time of publishing). For those who didn\u2019t pay ransom, we can reasonably assume that their losses were lower, between zero to US$1,000. We can simplify the matter and suggest that their financial losses could be US$500 on the average.<\/p>\n

(0.08 4,988 \u00d7 1,000) + (0.92 \u00d7 4,988 \u00d7 500) = 2,693,520<\/p>\n

Based on this calculation, DeadBolt causes about US$2,693,520 worth of economic damage to earn US$300,000. It\u2019s also interesting to think that the US$300,000 amount that they are asking for in exchange of the vulnerability details would probably be split among multiple members of the DeadBolt operation. Based on these numbers, DeadBolt actors are running the risk of incarceration for demanding millions of dollars from their victims, for a chance to earn only thousands, which doesn\u2019t seem to be a sensible risk quantification.<\/p>\n

Is it about the money, therefore, or about the damage caused? Are DeadBolt actors punishing society at large or just specific vendors? Or does this represent a refined business model that focuses on automation and volume, along with a chance to get a large single payout from affected vendors? These are some of the questions that we are left with after investigating ransomware groups such as DeadBolt.<\/p>\n

Security recommendations<\/span><\/h2>\n

Users and organizations can keep their NAS devices secure by implementing the following security recommendations:<\/p>\n