Blackmail At The Speed Of Light

Companies still refuse to take cybersecurity seriously heading into 2019, and the results are exactly what you'd expect to happen.

On Monday, New Year’s Eve, a hacker group announced it had breached a law firm handling cases related to the September 11 attacks, and threatened to publicly release a large cache of related internal files unless their ransom demands were met.

The news is the latest public extortion attempt from the group known as The Dark Overlord, which has previously targeted a production studio working for Netflix, as well as a host of medical centres and private businessesacross the United States. The announcement also signals a slight evolution in The Dark Overlord’s strategy, which has expanded on leveraging the mediato exert pressure on victims, to now distributing its threats and stolen data in a wider fashion.

In its announcement published on Pastebin, The Dark Overlord points to several different insurers and legal firms, claiming specifically that it hacked Hiscox Syndicates Ltd, Lloyds of London, and Silverstein Properties.

“Hiscox Syndicates Ltd and Lloyds of London are some of the biggest insurers on the planet insuring everything from the smallest policies to some of the largest policies on the planet, and who even insured structures such as the World Trade Centers,” the announcement reads.

It is unclear what exact files the group has stolen, but it is trying to capitalize on conspiracy theories around the 9/11 attacks.

“We'll be providing many answers about 9.11 conspiracies through our 18.000 secret documents leak,” the group tweeted on Monday.

If there's one thing the Trump era has taught us, it's that the lawyers know everything, so if you need blackmail material, they're always a good place to start.

The hacking group published a small set of letters, emails and other documents that mention various law firms, as well as the Transport Security Administration (TSA) and Federal Aviation Administration (The TSA could not provide a statement in time for publication, and the FAA told Motherboard in an email it was investigating.) Those documents themselves appear to be fairly innocuous, but the group says it may release more.

In its extortion note, The Dark Overlord included a link for a 10GB archive of files it allegedly stole. The group also provided a link to this archive to Motherboard before publishing its announcement. The cache is encrypted, but the hackers are threatening to release the relevant decryption keys, unlocking different sets of files at a time, unless the victims pay the hackers an undisclosed ransom fee in Bitcoin.

“Pay the fuck up, or we're going to bury you with this. If you continue to fail us, we'll escalate these releases by releasing the keys, each time a Layer is opened, a new wave of liability will fall upon you,” the extortion note reads.

The Dark Overlord is also claiming to be offering to sell the data on a dark web hacking forum, and is attempting to blackmail individuals who may be included in the documents themselves.

“If you're one of the dozens of solicitor firms who was involved in the litigation, a politician who was involved in the case, a law enforcement agency who was involved in the investigations, a property management firm, an investment bank, a client of a client, a reference of a reference, a global insurer, or whoever else, you're welcome to contact our e-mail below and make a request to formally have your documents and materials withdrawn from any eventual public release of the materials. However, you'll be paying us,” the group’s post reads.

Good luck catching them, too.   Nothing has made internet crime more viable than the rise of cryptocurrency over the last five years.  Frankly, anyone enabling the spread of it basically deserves what will happen next.