Hackers are investing in each other’s operations—just like VCs invest in startups
Over the past few years, ransomware operations have become increasingly sophisticated as they shake down everyday internet users, giant corporations, and government agencies for ransoms that can sometimes total in the millions of dollars. Now, according to the cybersecurity firm LIFARS, the underground world of ransomware is essentially developing its own venture capital ecosystem, with ransomware attackers pooling their funds to back new criminal operations in exchange for a cut of future earnings.
“Outside of ransomware, I don’t think that ever actually happened, that you’ve had a VC ecosystem in a criminal cyberscape,” says LIFARS cofounder and CEO Ondrej Krehel. “This is very unique.”
Not unlike in Silicon Valley, calls for investors are often accompanied by descriptions of founders and their prior achievements—in this case, notable previous hacks, Krehel says. The calls to invest that LIFARS is aware of take place through secure chat apps like Telegram, where certain groups are accessible only to people who can demonstrate they’re already involved in digital crime, usually by sending a token amount of cryptocurrency traceable to a ransomware incident or something similar to a certain address.
