There’s Only One Thing You Can Rely on Cyber Criminals For

Cyber criminals turning on each other sounds like good news.

One ransomware group threatening another. Identities potentially being exposed. Stolen information being leaked.

Some criminals have even claimed they'll help victims caught in the middle.

For a moment, you might think:

Maybe the criminals attacking each other could actually work in our favour?

Unfortunately, there's only one thing you can reliably expect from cyber criminals.

They'll look after themselves.

When cyber criminals turn on each other

The cyber criminal world isn't one big organised group working towards the same goal.

Different ransomware gangs compete with each other. Relationships break down. Money causes arguments. And occasionally, those disagreements become very public.

Recently, one ransomware group began making threats against another.

They claimed they could expose identities, release information and even help some victims recover encrypted files.

If your business had been hit by ransomware and someone suddenly appeared offering a way out, that could understandably sound tempting.

Especially when you're under pressure to get systems running again.

But there's a fairly significant problem.

You're still dealing with cyber criminals.

There is no trustworthy side

These groups aren't suddenly motivated by fairness or a desire to help businesses.

They're looking for leverage.

Money.

Influence.

Reputation within the criminal community.

Or an advantage over another group.

Even when cyber criminals attack each other, their underlying motivations haven't necessarily changed.

So when one criminal organisation claims it can help the victims of another, there are some obvious questions.

Can they actually do what they're promising?

Why are they offering to help?

What do they want in return?

And what happens if you give them access to your systems or information?

There are no guarantees.

Even if they genuinely possess information or tools that could help, you're dealing with people who have absolutely no obligation to keep their promises.

It's effectively being caught between two scammers and hoping one of them is the honest one.

That's not a recovery strategy.

Your recovery plan shouldn't depend on an attacker

This is where the story becomes relevant to every business - even if you're never caught between two rival ransomware gangs.

When a serious cyber incident happens, decisions suddenly need to be made very quickly.

Can we recover our data?

Should we shut systems down?

Who needs to be contacted?

How did the attacker get in?

Are they still inside the network?

How quickly can we get people working again?

Those aren't questions you want to be answering for the first time during an attack.

And you certainly don't want your options to depend on trusting the people responsible for cyber crime.

Give yourself better options

The best time to think about recovering from a cyber attack is before one happens.

That means having sensible protections and processes already in place.

Reliable backups should exist and, importantly, you should know that they can actually be recovered.

Security monitoring can help identify suspicious behaviour before an attacker has had days or weeks to move around your systems.

Your business should also have an incident response plan so the right people know what needs to happen if something serious is detected.

And your security shouldn't depend entirely on stopping every attack at the front door.

No security system can guarantee that.

Instead, the aim should be to reduce the likelihood of an attack succeeding, detect suspicious activity quickly and give your business reliable options for recovery.

Because if the worst does happen, you want to be talking to trusted security professionals - not deciding which cyber criminal you trust more.

If you're not completely confident about how your business would respond to a cyber attack, we can help you review your security, backup and recovery arrangements and put a clearer plan in place.