Ransomware Crooks Now SIM Swap Executives' Kids To Pressure Their Parents (theregister.com) 13
An anonymous reader quotes a report from The Register: Ransomware infections have morphed into "a psychological attack against the victim organization," as criminals use increasingly personal and aggressive tactics to force victims to pay up, according to Google-owned Mandiant. "We saw situations where threat actors essentially SIM swap the phones of children of executives, and start making phone calls to executives, from the phone numbers of their children," Charles Carmakal, Mandiant's CTO, recounted during a Google Security Threat Intelligence Panel at this year's RSA Conference in San Francisco on Monday.
"Think about the psychological dilemma that the executive goes through – seeing a phone call from the children, picking up the phone and hearing that it's somebody else's voice? Sometimes, it's caller ID spoofing. Other times, we see demonstrated SIM swapping family members." Either way, it's horrifying. It's the next step in the evolution of ransomware tactics, which have now moved far beyond simply encrypting victims' files and even stealing their data. "There are a few threat actors that really have no rules of engagement in terms of how far [they] try to coerce victims," Carmakal noted, recalling ransomware incidents in which the criminals have directly contacted executives, their family members, and board members at their homes.
The criminals have moved from just staging an attack against a company, its customers and their data, and becomes "more against the people," he added. It changes the calculation involved in deciding whether to pay the extortion demand, Carmakal said. "It's less about 'do I need to protect my customers?' But more about 'how do I better protect my employees and protect the families of employees?' That's a pretty scary shift."
"Think about the psychological dilemma that the executive goes through – seeing a phone call from the children, picking up the phone and hearing that it's somebody else's voice? Sometimes, it's caller ID spoofing. Other times, we see demonstrated SIM swapping family members." Either way, it's horrifying. It's the next step in the evolution of ransomware tactics, which have now moved far beyond simply encrypting victims' files and even stealing their data. "There are a few threat actors that really have no rules of engagement in terms of how far [they] try to coerce victims," Carmakal noted, recalling ransomware incidents in which the criminals have directly contacted executives, their family members, and board members at their homes.
The criminals have moved from just staging an attack against a company, its customers and their data, and becomes "more against the people," he added. It changes the calculation involved in deciding whether to pay the extortion demand, Carmakal said. "It's less about 'do I need to protect my customers?' But more about 'how do I better protect my employees and protect the families of employees?' That's a pretty scary shift."
CEO gets to feel like (Score:3)
a regular worker for a change. If they got a more sane pay packet, I might feel for them more.
I took actual pleasure in seeing this. (Score:2)
Re: (Score:3)
"essentially" (Score:2)
There's rules??? (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The rules of engagement, up until now, were pretty much "don't piss anyone off who could actually get laws changed that keep us from fleecing the flock".
Pretty short on details (Score:4, Informative)
TFA claims that "threat actors essentially SIM swap the phones of children of executives", yet doesn't give any details. There are no 'this specific set of events occurred but the names have been changed'. There is no explanation of how the threat actors are SIM swapping kids' phones. There are just a bunch of vague assertions. The entire article - which is really short - comes across as FUD.
I'm sure that hacking into providers' systems to reassign cell numbers occurs, and it wouldn't surprise me to learn that the people who do that hacking would collaborate with ransomware thugs in order to extort money. But The Register doesn't make a very convincing case for that.
The article also makes a token mention of regular folks being victimized, but spends the majority of its words lamenting the hardships faced by those poor c-suite occupants. WTF? Way to go Register!
Legit! (Score:2)
It's less about 'do I need to protect my customers?' But more about 'how do I better protect my employees and protect the families of employees?
Yep, that is definitely the first thing that a CEO would think. Bless them all.
Good (Score:3)
If it happens to the kids of "important" people, maybe we're gonna see some improvements in security.
Re: (Score:2)