Ugh. This ransomware crap doesn't stop until the money stops. At this point, ransomware operators are bribing insiders to install their custom, AV-evading ransomware directly on company servers (e.g. https://www.secureworldexpo.com/industry-news/fbi-sting-the-...). No need to trick someone into running a malicious Word attachment when you can just wire someone $1M to do it deliberately! And, best of all, you can set this up in a totally plausibly deniable way - the employee just "accidentally" opens that attachment and off you go.
A lot of ransomware operators are on sanctions lists. Paying them is already illegal. The US DoJ might want to check if Colonial has violated any laws in making these payments - and if they have, punishing them to serve as an example could well discourage future ransomware payers. As long as ransomware operators know they can get paid for their work, they're going to keep doing it.
A lot of ransomware operators are on sanctions lists. Paying them is already illegal. The US DoJ might want to check if Colonial has violated any laws in making these payments - and if they have, punishing them to serve as an example could well discourage future ransomware payers. As long as ransomware operators know they can get paid for their work, they're going to keep doing it.