The Dark Angels ransomware group recently secured a record $75 million ransom payment from an undisclosed victim, surpassing the previous record of $40 million paid by insurance giant CNA Financial in 2021. In contrast, Seattle Public Library is suffering from a month’s long attack, and ostensibly not paying a ransom.
I wonder who will get attacked again. Did a little tabletop exercise using various analysis models to find support for attacks on the entity that Paid (EtP) or Seattle Public Library (SPL)
Scenario 1: Attackers Reattack an Entity that Paid
Economic Theory (Rational Choice Theory)
- High-Value Targets: The entity that previously paid a large ransom, such as the undisclosed victim of the $75 million payment, is an attractive target because it has already demonstrated its ability and willingness to pay. The potential financial reward outweighs the costs and risks of another attack.
Behavioral Economics
- Heuristics and Biases: Attackers may use the availability heuristic, believing that an entity that has paid a large ransom in the past is likely to pay again. This past behavior is seen as a predictor of future actions.
Risk Analysis
- High Reward, Predictable Behavior: The previously compliant entity is seen as a high-reward target with a predictable likelihood of paying again. The risk of attack is justified by the substantial potential payoff.
Network Theory
- Highly Connected Entities: If the entity is well-connected within its industry, compromising it again could provide access to additional valuable targets or sensitive information, amplifying the potential rewards.
Game Theory (Extended Models)
- Signaling Theory: Reattacking a high-paying entity sends a message to other potential victims that payment is the preferred course of action. This reinforces the attackers’ reputation and can deter resistance in future targets.
- Repeated Games: In the long term, attackers aim to maintain a reputation that ensures future compliance by demonstrating the benefits of paying a ransom.
Cybersecurity Posture Analysis
- Weak Defenses, Inadequate Response: If the entity has not significantly improved its cybersecurity posture since the last attack, it remains vulnerable, making it an easy and lucrative target.
Sociopolitical Factors
- Regulatory Environment: Entities in regions with lenient regulations regarding ransom payments are more likely to be reattacked. The regulatory context can influence the attackers’ perception of the likelihood of receiving payment.
Technological Factors
- Exploitable Vulnerabilities: Entities using vulnerable or outdated technologies, which were previously exploited, remain at risk. Attackers may continue to exploit these known weaknesses.
Scenario 2: Support for Attackers Reattacking Seattle Public Library
Game Theory (Extended Models)
- Signaling Theory: Continuously attacking the Seattle Public Library sends a message to other entities that refusal to pay will result in prolonged and disruptive attacks. This tactic aims to break the resistance of future targets by setting a deterrent example.
- Repeated Games: Attackers maintain a strategy where non-compliance is punished to create a deterrent effect. This establishes a long-term reputation that encourages future compliance.
Behavioral Economics
- Prospect Theory: Attackers leverage the fear of prolonged operational disruption and reputational damage. The library’s ongoing suffering serves as a powerful example of the costs associated with non-payment, exploiting the psychological impact on other potential victims.
Risk Analysis
- Low Security, Low Reward but Persistent Attacks: Although the financial reward from attacking the library is low, the persistent attack serves to create a deterrent effect, reducing future risks of encountering non-compliant targets.
Network Theory
- Peripheral Nodes in a Network: The library, while not a high-value target, is part of a broader network of public institutions. Continuous attacks can serve as practice or testing grounds for attackers, and the visible impact on one public institution can pressure others in the network to comply.
Cybersecurity Posture Analysis
- Weak Defenses, Poor Response: The library’s inability to effectively respond to and resolve the ongoing attack highlights its weak defenses, making it an easy target for repeated exploitation. This persistent vulnerability is exploited to set an example.
Sociopolitical Factors
- Public Impact: The highly visible and public nature of the Seattle Public Library amplifies the impact of the attack. Media coverage and public awareness increase the pressure on similar institutions to comply with ransom demands to avoid similar disruptions.
Technological Factors
- Vulnerable Technology Users: Public institutions like libraries often use outdated or vulnerable technology due to budget constraints. This makes them easy targets for attackers who can repeatedly exploit these known weaknesses.
Summary of Analysis
Reattacking an Entity that Paid:
- Attackers are motivated by the high potential reward, predictable compliance, and weak defenses of a previously paying entity. The strategy is reinforced by economic theory, behavioral economics, risk analysis, network theory, game theory, cybersecurity posture analysis, sociopolitical factors, and technological vulnerabilities.
Reattacking Seattle Public Library:
- Attackers aim to set a deterrent example by demonstrating the consequences of non-payment. This strategy leverages game theory, behavioral economics, risk analysis, network theory, cybersecurity posture analysis, sociopolitical factors, and technological vulnerabilities. The goal is to create a climate of fear and compliance among other potential victims, using the library as a high-visibility example.
Ransomware attackers are likely to reattack high-value entities that have previously paid large ransoms, as seen in economic and behavioral theories, due to the predictability of compliance and substantial rewards. Conversely, targeting the Seattle Public Library, despite its lower financial value, serves as a deterrent example to other potential victims. This strategy exploits weak defenses and psychological pressure, signaling severe consequences for non-payment.
Candidly, I still wonder which will happen!
