Ransomware? Back online in no time

Hugely stressed

Every ransomware attack is different, because no company is the same. But Gevers sees similar situations in every attack. 'When somebody calls us, first we listen. Usually people need to get rid of this load; they are really stressed. We try to exude a certain calmness.'

'For example, I was called once by a man with a very large company in the manufacturing industry. He told me: 'They want 20,000 euros.' So I said, 'Oh, that's not so bad.' That was the trigger for him to think, yes, it's actually not that bad. After that, he relaxed. Incidents tend to go more smoothly when people are calm.'

Are there any backups?

After that first phone call, Gevers and Blokhuis strengthen their intelligence position. 'We check: which ransomware group is behind this? How is the affected party doing? For example, which systems are inaccessible? What does that mean for the company?' But the most important question is: are there any backups? And how long will it take before they can be restored?

'About three years ago we still met a lot of companies who didn’t have backups,' says Blokhuis. 'That meant you had to pay up; you had no other option. But we’re happy to see that less often nowadays; backups are getting better.'

Negotiating with ransomware groups

When, and only when, Gevers and Blokhuis have fully strengthened their information position they open a chat with the ransomware group behind the attack. Their goal is to reduce the amount of money the group is demanding. ‘Negotiating with ransomware groups is something we have become very good at,’ Gevers says.

To be clear: Blokhuis prefers not to pay criminals a ransom. 'But we find in practice that paying the ransom is often the fastest route to recovery. For us, it's about weighing the costs against the benefits.' He always consults with an organization's management about this trade-off during an attack.

It goes something like this: 'Suppose you're down for a day because you need a day for recovery, to restore the backups. That means losing 2 million euros – these are random numbers, by the way. But: if we pay the ransom it costs 200k. With a few clicks we can transfer that money, get the decryptor and be back online in 4 hours. Then we pay. These are the kinds of calculations that are made.'

To pay or not to pay

To pay or not to pay in case of ransomware is a sensitive issue. The Dutch government never pays. 'Sometimes that really hurts,' says Gevers. A ransomware group might ask for 10,000 euros. The government party then decides, 'We won't pay.' And the damage could be in the millions.'

Gevers sees that the willingness to pay a ransom varies by country: 'In the UK, paying a ransom is not done. Almost nobody pays. Willingness to pay is also limited in the Netherlands, although the threshold for paying ransom is lower there now than it was a few years ago. In Germany, on the other hand, companies often do pay. I think that's because Germany is more privacy-minded.'

Very occasionally a payment turns out unexpectedly well. In 2022, Gevers and Blokhuis managed to withdraw payment of the ransom after receiving the decryptor: 'A trick. So in that particular case we never paid at all.' They shared this info with law enforcement, allowing police to extract over 155 keys from that specific ransomware group.

Satisfaction

When is an assignment successful? 'When the customer is satisfied. I also get a kick when things go really fast. When we solve the problems within a few hours and the customer says, ‘Wait, is it over already?'

The work also gives him a certain satisfaction. 'A while back we got a call from a party that worked with a lot of vulnerable people. They let us know: if the data of these people gets online, it will cause a lot of serious problems. Very sensitive data, in other words. We ended up working on it for a long time, but it turned out all right.'