Keeping ransomware cash away from your business

A ransomware gang has made headlines for donating a big chunk of stolen funds to two charities. Two separate donations given to Children International and The Water Project rang tills to the tune of $10,000 each. Their reason was that they’re targeting “only large profitable corporations, we think it’s fair that some of the money they’ve paid will go to charity. No matter how bad you think our work is, we are pleased to know that we helped change someone’s life.”

This has raised several questions outside the usual “Is it morally right to pay a ransom” debate. It’s a whole new world of “Is it morally acceptable for ransomware authors to donate ill-gotten gains to charities, Robin Hood style?”

“Steals from the rich, gives to the poor?”

In theory it sounds sort of nice. As the malware slingers suggest, some good is coming from it somewhere along the line.

However, the reality outside the theory is rather different. Replace “stolen funds donated from ransomware authors” with “stolen funds donated from criminal gangs”. It suddenly sounds a lot less abstract and cyberpunk and a lot more like somebody is going to jail.

This isn’t “just” a risk to charities, either – any organisation could get into trouble from similar dealings. If malware authors are splashing the cash, it’s a danger to everyone. People and organisations drop links to their Venmo accounts, or their tip jars, all the time. With so many ways to donate, it’s never been more difficult to ensure your funding is legit. Phone, text, online, money in an envelope. Perhaps from your own country, or international donations, a speedy online processor, or even Bitcoin. The possibilities are endless.

When the Robin Hood mindset spreads…

Are the ransomware authors genuine in their desire to help people less fortunate than themselves? Or is it a bad cover story to justify breaking into servers and make off with some cash? It doesn’t help the recipients at all. We’re talking serious ramifications for the charity trustees with potential criminal charges waiting in the wings. The charity itself could suddenly discover it sits on very perilous ground indeed.

There are few things more damaging to a business than losing trust from the general public. That’s especially the case where your business model is asking them for money.

If stolen cash donations to assuage guilt takes hold, we could find ransomware authors passing cash outside the charity realm. Is your business an SME with no chance of going head to head with the big players? No worries, your friendly neighbourhood ransomware author is here to help. Perhaps they start playing favourites. Suddenly, the boss of that struggling firm is now asking the ransomware authors for a cut.

In a few short steps, we’re moving from “Giving some money to charities is okay even if it’s stolen because they need it” to “Oh no, Uncle Paul’s set up a money laundering syndicate and he’s supposed to be selling fax machines”.

Many pieces of advice for UK charities are good suggestions for businesses generally. To steer clear of dubious payments, you could stand to pick up a few tips from their selection of guidance. By showing how regulated funds are in the charity industry, you’ll see how serious it is everywhere else as well.

Charitable basics

In the UK, the Charity Commision is a non-ministerial Government department. Those departments typically make things work by regulation, theoretically free of politicisation. Government with a small “g”, perhaps.

They regulate charities in England and Wales, advise on scams, provide a list of registered charities, and much more. They also provide a significant volume of advice on ensuring charity activities are above board. There’s lots of ways your charity (and, by extension, unrelated business) can get into trouble where bogus donations are concerned.

Remember what I said about ransomware Robin Hood donations spreading from charities to lots of other donation/tipping mechanisms? It’s time to take a trip to the cleaners, because money laundering is the big threat here. It means little whether it’s done via traditional means or malware shenanigans.

Laundering for fun and profit

“Laundering” cash means taking unclean, dirty money and rinsing the badness out. If I turn up at the bank with a mysterious haul of one million dollars, it’s going to look odd. If I scatter it across multiple banks, it looks much better. Coming up with ways to ensure the banks can’t spot all the bills came from heist X or Y, evading whatever technology/system is in place, is where we’re cooking with gas.

There are all sorts of laundering techniques, and all businesses need to be careful. Charities are particularly at risk, because they’re essentially a large bowl with a “please deposit money” sign above it. If you’re an individual with a Gofundme, do you know where all your donations are coming from? That everyone donating is legit? Of course you don’t. Now consider that you’re a large, international organisation with many ways to donate. Consider your daily transaction volumes. Your own business almost certainly has the same problems facing it, even if you haven’t considered until now in terms quite so stark. Scary, right?

Ransomware authors are potentially doing the charities a favour by being vocal. Otherwise, they’d have ten grand rattling around in their coffers sourced from an unwilling company struck by a criminal attack.

“That’s not laundering though, is it?”

Not yet, but giving the money to a charity could be the first step. Money doesn’t have to go to banks. It can be dropped into shell organisations, thrown into the gambling area, placed into businesses known as “fronts”. You could also give it to a legitimate charity, who receives large donations regularly, and then try to reclaim the cash. Perhaps the fraudsters begin a phishing campaign for financial details and the cycle begins again.

Maybe they have someone working on the inside at their chosen charity, or (worse) perhaps the charity itself is bogus. They could even claim they’d donated too much money, or the entire donation was an accident and would like their money back.

However you stack it up, this should be a major concern for any organisation. Normalising the movement of stolen money can only end poorly.

Freedom fighter or terrorist?

Even without the laundering aspect, simply receiving money from a malware group with ties to terrorism will likely end up being disastrous. To stress how serious this is [PDF], involvement in laundering in the UK is an offence prohibited under various Acts of Parliament and terrorism is also a massive no-no [PDF, Page 15]:

• Proceeds of Crime Act 2002
• Terrorism act 2000
• Anti-Terrorist crime and security act 2001
• Counter-Terrorism Act 2008

You don’t need to be a charity to want to avoid getting caught up in one of those potential headaches.

Strategies for dealing with fraud and financial crime

The previously mentioned Charity Commision documents for dealing with monetary fraud [PDF] are, as has been mentioned, very good [PDF] and almost certainly usable at your current organisation. In no particular order, here are some of the best. Regular readers will note many of these are staple pieces of advice on the Labs Blog, and there are many more on the linked documents. Not all of them will be applicable to your business, but they’re good things to keep in mind.

1. Design appropriate internal financial controls, ensuring funds are properly accounted for, based on risks related to type, size, and activities.
2. Perform regular audits of security protocols, make multiple people responsible for various stages of fund transfers/authorisation, and deploy 2FA for online components.
3. Keep financial records for receipt/use of funds, check and verify both domestic and international transactions.
4. Never pre-sign blank cheques, it’s a clear in-road to fraud.
5. Consider what level of due diligence, monitoring, and verification of use of funds if required to meet your legal duties regarding safe flow of funds.

There’s also guidance on moving/receiving funds internationally [PDF] with useful information on types of banking, transfer, how to report incidents, and a checklist of potential concerns [PDF] when receiving money from overseas. Given the likelihood of ransomware authors donating from a country outside of your own, these are useful things to be aware of. Many online payment processors will flag potential fraud without you having to do anything, and it’s worth digging into the nitty-gritty before signing up to a merchant system.

A deal you’ll want no part of

As you may have gathered, one of the biggest issues here is that of the insider threat. Whether you’re a charity or a seller of hardware and software, the danger inside your walls can be fatal. Security is a multi-layered entity. Checks and balances required at digital, financial, and real-world levels keep things running smoothly. That’s why we have to do things like lock down printers, or restrict access to papers used for money transfers, or secure fax machines behind ID accessed security doors.

There’s always another problem to consider and then address, and securing your real world assets is just as crucial as your online security. When ransomware authors shift parts of their model from online to off, so too do we need to think about more ways to keep ourselves out of harm’s way.

In my opinion, there’s nothing helpful about handing stolen money to charities or anyone else. The moral arguments which exist are eclipsed by the legal ramifications. Malware authors are better served “helping” organisations by keeping their profits far, far away from legitimate businesses.

The post Keeping ransomware cash away from your business appeared first on Malwarebytes Labs.