Hackers are increasingly taking users’ data hostage and demanding huge sums for its release. They have targeted individuals, businesses, vital infrastructure and even hospitals. Authorities have been slow to respond – but there is help out there
Around 9pm on Monday 23 November 2020, the IT manager for a school in central London received a text message from a colleague, saying the school’s website was down. He tried logging on but couldn’t. At first, he thought he had forgotten the password. After several attempts, he realised that he was locked out.
The IT manager, Matthew (he asked us not to use his last name), works in a central London neighbourhood where affluence hides pockets of poverty, and migrant families from Pakistan, India and eastern Europe pin their hopes for their children on a small, publicly funded school. It has about 150 students aged between five and 10, many of them on free school meals. On a shoestring budget, in a Victorian building that’s showing its age, teachers track the students’ progress by photographing them as they learn how to hold a pencil, draw a picture or write their name. The snapshots and other progress reports are uploaded to a server, a powerful computer that processes data and provides services for other devices used around the school.
An affable Englishman in his early 40s with blond hair and a stubble beard, Matthew has guarded this irreplaceable trove of data on every child’s learning since 2016. Although the school can only afford to pay him a few thousand pounds a year as a contractor, he is devoted to its people and mission. When he found he couldn’t access the website, he was desperate.
At 2am, having exhausted other ideas, he finally contacted the help desk of the company that hosted the server. He obtained a new server and connected it to the school. With the fresh setup, Matthew could see the files listed in the directories, though he still couldn’t open them. They had been renamed with the file extension “.encrypt”. To his horror, he realised that the school had been hit by a ransomware attack – one of the world’s most pervasive and fastest-growing cybercrimes. A cross between hacking and cryptography, ransomware penetrates computers and renders files inaccessible without the right decryption key. The hackers then demand a hefty price for the string of characters that can unlock the information.
The hacker had entered the school’s system through a web portal that teachers used for content management. An update with improved security was available, but Matthew – who manages IT for a variety of clients and is so busy that he doesn’t always remember to patch vulnerable software – hadn’t installed it.
“I didn’t follow my own advice. I was so frustrated, and so embarrassed,” he said. “I felt like someone punched me in the stomach.”
As George Orwell once observed: “The history of civilisation is largely the history of weapons.” Today, digital weapons are reshaping the world, and ransomware poses what may be the greatest threat of all. It’s more efficient and profitable than other cybercrimes such as identity theft and, as we become dependent on the internet for every aspect of our lives, there is an almost limitless possibility for criminals to make money and create mayhem.
The frequency and the impact of ransomware attacks are widely understated because many victims don’t make them public or inform the authorities. But in recent years, hundreds of strains with odd names like Bad Rabbit and LockerGoga have paralysed the computer systems of millions of companies, government offices, nonprofit organisations and individuals. Exploiting society’s near-total dependence on computers, hackers demand thousands, millions, or even tens of millions of dollars to restore operations. During the pandemic, a wave of cyber-extortion crippled hospitals and other vital services, forced businesses and schools to close and further isolated people from relatives, friends and co-workers.
As he sifted through the digital wreckage, Matthew found a note. Titled Hack for Life, it read in part: “All Your Files Has Been Locked! The structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them. But with our help, you can restore them. We can decrypt all your files after paying the ransom. We have no reason to deceive you after receiving the ransom, since we are not barbarians and moreover it will harm our business.
“You Have 2days to Decide to Pay. after 2 Days Decryption Price will be Double. And after 1 week it will be triple … Therefore, we recommend that you make payment within a few hours.”
This wasn’t Matthew’s first brush with ransomware. He had previously worked for a software company that was attacked in 2018. For two days, he had tried to recover the company’s data without paying the hackers. Fearing that its reputation would suffer and investors would panic if the incident were to become public, the company had grown tired of waiting and instructed Matthew to pay the 2-bitcoin ransom (about $10,000 at the time). He received the key to unlock the files, and the company moved on quietly.
What was a hiccup for a prosperous business was a potential catastrophe for a cash-strapped school. “It would have made the assessments for the children impossible,” Matthew said. “It would have cost the teachers months of work. The government inspectors would have failed the school.”
After a sleepness night, he alerted his superiors, who authorised him to negotiate with the attackers. The school appeared to have no choice but to reward the criminals, incentivising them to target more schools. Matthew and his bosses would keep the attack secret. They wouldn’t report it to law enforcement, for fear of tarnishing the school’s reputation. In the meantime, they told teachers and parents the system was down.
The ransom note hadn’t named a price. “How much to decrypt my PC?” Matthew wrote to a Gmail address specified by the hackers.
“You have to pay 10000 euro,” came the reply. “Today 10000. Tomorrow 15000. Another two days 20000.”
Matthew knew the school couldn’t afford that, so he tried to bargain by pretending the attack hadn’t caused much damage.
“I simply don’t have 10,000 Euros to pay you, sorry, that’s ridiculous. We are a poor school with small resources. We have most of the data backed up, just a few recent photos I lost. Most I can pay is 500. Let me know if that’s okay.”
The strategy seemed to work, as the hacker reduced the demand: “1000 Euros Last Offer If you do not agree, we will have to end the conversation.”
Matthew was relieved. The school could scrape together €1,000. He seemed to have averted disaster. The hackers had demanded payment in bitcoin, which Matthew had invested in himself and knew how to obtain. He converted €1,000 to bitcoin on an online exchange and transferred it to a digital wallet specified by the criminals.
“OK it’s sent,” Matthew wrote. “Please let me know how to recover my files.”
“Sorry, 1000 Euros is not accepted You have to pay 10000 Euros. You owe another 9,000 euros I will send you the decryption file after payment.”
The criminals had double-crossed him. By pretending to compromise, the gang had extracted a downpayment without supplying a key. Matthew was too flustered to abide by the time-honoured negotiating rule of not letting your adversary see you sweat. He tapped out a desperate appeal. “You said 1000 euros last offer and we agreed the deal,” he wrote.
The attacker refused to budge. “I can not accept. I’m sorry. This is not my problem.”
Matthew scoured the internet, hoping for a miracle. On a site called BleepingComputer, he came across a forum for victims of VashSorena, a ransomware strain that, like the one that had paralysed the school’s network, added “.encrypt” to the end of file names.
“I had this ransomware today and paid the ransom but the criminal did not help,” Matthew posted on the forum. Instructions there advised him to upload the ransom note and a sample encrypted file for analysis to another site, ID Ransomware, and to contact its founder, who went by the handle demonslay335. If anyone could crack the code, they said, it would be him.
“Hi, my server that my school used to record their progress was hacked and encrypted,” Matthew messaged demonslay335. “Please can you help? I’m totally stuck.”
Michael Gillespie – demonslay335’s real name – was in the central Illinois flatlands, six time zones away from London, working at home in a modest upstairs office that formed an unlikely frontline in the war against ransomware. He and his wife, who have eight cats, two dogs and a rabbit, call it the “cat room”. His work setup consisted of a laptop on a desk and a monitor perched on a shelf above; the only other furniture was a fraying couch. Except for a poster of The Lion King, his favourite movie, the beige walls were largely bare, and there were dark patches in the skirting board where the rabbit had chewed.
Then about to turn 29, Gillespie had not had an easy road. He’d overcome bullying in school, poverty and cancer. When he was growing up, his family was so poor that they sometimes had to move in with friends or relatives. Gillespie couldn’t afford college. At age 16, he started working at a computer repair chain called Nerds on Call and remained there for more than a decade while teaching himself to crack ransomware.
Whenever he had a moment to spare, he decoded ransomware-infected files as a public service. Almost anonymously, without seeking recognition or reward, Gillespie had become one of the top ransomware breakers in the world. At least 1 million victims worldwide have downloaded decryption tools he created. Without charging them a penny, he has saved them from collectively paying hundreds of millions of dollars in ransom. Of more than 1,000 known types of ransomware, he has cracked more than 100.
The internet is his refuge and intellectual home, the place where he spends most of his waking hours and where he has gained a stature that would astonish his relatives and acquaintances in Illinois. “He lives so heavily in the tech world that I think having bad actors involved just bothers him,” said Dave Jacobs, who was the best man at Gillespie’s wedding. “Electronic stuff is his world, and he doesn’t want these things going on in it.”
Resourceful and tireless, Gillespie is the most prolific member of the Ransomware Hunting Team, an elite, invitation-only society of about a dozen tech wizards who are devoted to cracking ransomware. Across the globe, this obscure band of volunteers is often the only recourse for victims who can’t afford – or refuse out of principle – to pay ransoms to cybercriminals. The team has cracked more than 300 major ransomware strains and variants, saving an estimated 4 million victims from paying billions of dollars in ransom.
Most of the Ransomware Hunting Team members, like Gillespie, are improbable success stories, with a technical virtuosity that’s largely self-taught. Some come from backgrounds of poverty or abuse that helped galvanize them to fight bullies. Because they’re combating criminals who might retaliate against them, several hide behind aliases or online identities. Most have never met in person.
The hunters are devoted to the cause and to each other. When one is in dire financial straits, a teammate is sure to step in with a donation or a job offer. They reside in at least seven countries – the US, the UK, Germany, Spain, Italy, Hungary and the Netherlands – but, in a very real sense, they live on the internet. They converse among themselves over a messaging platform, and with cybersecurity experts, consulting firms, tech aficionados, victims and even attackers on BleepingComputer, where Matthew had posted his plea for help. Run by one of the team’s founders, BleepingComputer is a demilitarised zone and a neighbourhood pub, a place where the good and bad actors of the ransomware world intersect.
The team’s members have regular jobs, typically in cybersecurity, but cracking ransomware is their passion. Several have a kind of tunnel vision – once they commit to solving a problem, they plug away at it nonstop for hours or days, oblivious to the world around them. They don’t care about getting rich; otherwise, they might be devoting their skills to developing ransomware, not foiling it.
Sign up to The Long Read
Lose yourself in a great story: from politics to psychology, food to technology, culture to crime
“I think we’re all kind of misfits,” said team member Fabian Wosar, a high school dropout who grew up in Germany but now lives and works outside London. Wosar is Gillespie’s mentor and, along with him, the team’s foremost codebreaker. “We all have weird quirks that isolate us from the normal world but come in handy when it comes to tracking ransomware and helping people. That’s why and how we work so well together. You don’t need credentials, as long as you have the passion and the drive to teach yourself the skills required.”
The team filled a gaping void. The US government was slow to respond to the growing ransomware threat. The FBI couldn’t get a handle on it, advising victims against paying ransoms but offering no practical alternative. The hackers often operated out of countries such as Russia and Iran, which don’t have extradition agreements with the US and tacitly condone cyber-attacks on the western world, possibly using them to gather intelligence or share in the profit. From insurers to cybersecurity firms, the private sector had little incentive to thwart ransomware; as it surged, they benefited.
The team can’t crack every strain. When ransomware is done right, it’s unbreakable. But some attackers make blunders, cut corners or underestimate their adversaries. That’s when the team pounces.
Though their moral worlds are miles apart, ransomware hackers and hunters have many qualities in common. Even as they were playing cat and mouse, ransomware developers reached out to compliment, insult or banter with the hunters – and to try to manipulate them. They shared the team’s fascination with ransomware and many of the same skills. They were avid readers of the forums on BleepingComputer, especially when it broke news of their exploits. Wosar, in particular, was so talented at cracking the hackers’ codes that he attracted admiration as well as abuse. He and the hackers are “kindred spirits”, Lawrence Abrams, who founded and runs the BleepingComputer site, said. “It’s almost like a competition between them.”
Within the ranks of hunters and hackers are self-taught, underemployed tech geeks who sometimes lack social graces, enjoy video games and are familiar with some of the same movies. The HakunaMatata ransomware strain, for instance, was named after an Oscar-nominated song from Michael Gillespie’s beloved Lion King. Like the Ransomware Hunting Team, most of the attackers are young men. They are concentrated in eastern Europe, although scattered globally. In countries such as Russia and North Korea, some gangs appear to enjoy a degree of government protection – and, in some cases, to be weapons in an undeclared cyberwar.
Some of the hackers pride themselves on abiding by a code of ethics. For example, they generally uphold their side of the bargain and restore computer access upon receiving a ransom. The gangs recognise that if they earn a reputation as double-crossers, future victims will be less likely to pay. They rationalise their extortion in all sorts of ways. But even when they say it isn’t about the money, it probably is. Their greed is the biggest difference between them and the Ransomware Hunting Team.
Wosar cracked so many ransomware strains that thwarting hackers became almost routine. So he was amused when those triumphs were accompanied by the occasional outburst of theatrical praise or protest from the villain. Some fawned on him: “FWosar you are the man,” a developer inserted in the text of NMoreira ransomware in late 2016. “I am inspired by dudes who understand what they do. Hope you can break this too, Im not being sarcastic, youre really inspiring. Hugs.”
Beaten hackers sometimes embedded messages to their nemesis in their ransomware code. Others pleaded with him. “Wosar, please, don’t crack me!” one attacker wrote. “It is my last attempt, If you crack this version then I will start taking heroin!” Unmoved, Wosar broke the ransomware and built a decryptor.
More often, the hackers insulted him. Taunts like “Crack me again, Wosar! Show that you got balls!” stood out in the long lines of numbers and letters. At some level, Wosar was pleased to be noticed. “They’ve taken the time and effort to write a message knowing that I’ll probably see it and I’m clearly getting under their skin,” he he told the BBC in 2019. “It’s a pretty good motivator to know that my work is upsetting some really nasty cybercriminal gangs.”
Ransomware is kidnapping updated for the digital age. Using ploys such as phishing – sending deceptive emails with malicious attachments – hackers infiltrate computers. Once inside, they detonate the ransomware and hold the computers hostage for cryptocurrency.
Cryptography, a basic element of ransomware, has become a backbone of the internet, safeguarding electronic banking, commerce and communications. Unfortunately, legitimate cryptographic tools developed by government, industry and academia have been co-opted by cybercriminals for their own purposes.
Ransomware’s innovation was to weaponise the very act of encryption. Before the emergence of ransomware, hackers who breached computer systems still had a lot of work to do before they could cash in. They had to find buyers for stolen social security or credit card numbers, with all the associated delays and uncertainties. Ransomware made the hack itself profitable, by monetising victims’ reliance on their computers. It is a one-stop crime, so simple in concept and execution that any would-be extortionist can buy a ransomware package on the dark web – the world of online content that is not accessible through standard search engines.
In his office that Tuesday in late November 2020, Gillespie was so inundated with pleas from other victims that he barely had time to glance at the file Matthew sent him. A quick look convinced him that the school had been attacked by version six of an unbreakable ransomware strain, Ouroboros, named after the ancient icon of a serpent eating its own tail.
“Ouroboros v6, not decryptable since October 2019 when they fixed the flaws,” he wrote to Matthew. In his frustration, Gillespie added: “ID Ransomware would already have told you.”
Matthew pushed back. “I did check the ID Ransomware earlier, and it says its a different one.” Gillespie’s own website identified the ransomware strain as VashSorena and categorised it as decryptable under the right circumstances. “Is it just a different name or is there indeed a chance I can decrypt?” Matthew asked.
Re-examining the characters in the file name, and other indicators, Gillespie realised that he had been mistaken. His error was understandable: Iranian hackers are believed to be behind both the Ourobouros and VashSorena ransomware strains, which encrypt files in almost the same way. Gillespie set to work. VashSorena’s vulnerability lay in a shortcut that the criminals had taken. In order to track who paid the ransom and who didn’t, VashSorena’s ransom note assigned each victim a unique ID number. This was standard practice in ransomware. Also standard was that, in return for payment, each victim received a unique key to unlock the encrypted files. What was unusual was that the ID and the key were related to each other. That created an opening for Gillespie.
In July 2020, Gillespie had cracked the first version of VashSorena. But, as he often did, he kept the news quiet. If the attackers learned about it, they would fix the flaw he exploited. Helping hackers polish their cryptography was the last thing the Hunting Team wanted to do. While Gillespie rescued at least 40 victims who reached him through BleepingComputer, he didn’t post his solution. This low-key approach appeared to work: although the attackers updated VashSorena five times, they didn’t fix the weakness Gillespie identified.
Using the ID number from the ransom note supplied by the victim, Gillespie broke into the malware and generated the key to unlock the files. He then wrote a decryptor, a computer programme that the victim can run to recover data. He generated a key and sent it to Matthew. “Took another look,” Gillespie wrote. “It is VashSorena actually, and I was able to break your key.”
It was late evening when Matthew got the message. Following Gillespie’s instructions, he regained access to the old server and recovered the student photos and other files. “Well, amazing,” he wrote Gillespie. “It is working. I can’t thank you enough. How did you do it? The teachers and children at the school will be so grateful you could help them.”
Matthew wasn’t finished. He submitted an online complaint to Google, asking why it allowed a ransomware attacker to use Gmail. The company didn’t respond. The London school recognised that, despite its meagre budget, it had to improve its cybersecurity. At Matthew’s urging, it bought a network-attached storage device, or NAS, for additional backup.
He also hatched a scheme to recoup the €1,000 from the VashSorena gang. Pretending he still needed a key, he resumed negotiating with them. “The only way I can trust you again is you send me back [the bitcoin],” he wrote. “Then I will send you the 3000 Euros total to retrieve my files.”
But ransomware gangs don’t give refunds. “I’m sorry,” the hacker wrote, ending the conversation. “If you give me this offer for another 10 years I reject it.”
After a high-profile ransomware attack in May 2021 on the Colonial Pipeline stopped the flow of almost half of all fuel consumed on the east coast of the US, shuttering gas stations across the south-east, the federal government raised ransomware to the same priority level as terrorism. The FBI has become more willing to cooperate with private researchers, including the Ransomware Hunting Team. But the attackers are also getting savvier. Their cryptography is improving, and they are picking targets more shrewdly. The battle is escalating on both sides, and businesses, schools, hospitals and government agencies disabled by ransomware will need the team more than ever.
This is an edited extract from The Ransomware Hunting Team: A Band of Misfits’ Improbable Crusade to Save the World from Cybercrime, published by Farrar, Straus and Giroux on 25 October 2022 and available at guardianbookshop.co.uk
Follow the Long Read on Twitter at @gdnlongread, listen to our podcasts here and sign up to the long read weekly email here.
