How does genuine ransomware exist?

Question

Typically, ransomware will encrypt the victim's files and ask for money in exchange for the decryption key.

If you do pay the ransom, does it actually deliver on this promise? It seems to me that having employed the ransomware in the first place, the operator has already proven himself unreliable and willing to act in bad faith. Once you do pay the money, what's stopping him from simply disappearing without giving you the key?

Why even have the key in the first place, when you can just delete the files (or overwrite with random data) and then claim they are encrypted when asking for money?

Answer 1

While other answers state that it makes sense for the malware authors to deliver on their promise to decrypt your files (I agree, it does) they offer no evidence. Anecdotal evidence is the best you'll get in the case, but it is not unheard of that the criminals will actually decrypt your files for you.

This New York Times article details how the author's mother's computer became infected with ransomware. Here are some selected sections to answer your question:

Of course, this advice arrives too late for my mom. And it appeared her payment had arrived too late as well: By the time I got home from Greenpoint, her CryptoWall ransom had been raised to $1,000, and the $500 in Bitcoins she had deposited had vanished. In a panic, she wrote to Mike Hoats asking for advice. What he told her sounded crazy to me. Use the CryptoWall message interface to tell the criminals exactly what happened. Be honest, in other words.

So she did. She explained that the virus had struck the same week that a major snowstorm hit Massachusetts and the Thanksgiving holiday shut down the banks. She told them about the unexpected Bitcoin shortfall and about dispatching her daughter to the Coin Cafe A.T.M. at the 11th hour. She swore she had really, really tried not to miss their deadline. And then a weird thing happened: Her decryption key arrived.

But Mr. Wisniewski had a more pragmatic take. “From what we can tell, they almost always honor what they say because they want word to get around that they’re trustworthy criminals who’ll give you your files back.”

Welcome to the new ransomware economy, where hackers have a reputation to consider.

Additionally Dark Reading cites two additional cases of police departments paying the ransom, and getting their files back.

However keep in mind, there are many types of ransomware written by many different programmers with varying level of skill. Some will simply not give you a decryption key, and I image some botch their whole malware and can't offer decryption keys. Other cases have been known in which the decryption key is stored on the victims computer, and you can recover your files without paying anything(example).

Answer 2

Well, it makes sense to deliver the key on payment.

If they simply disappear, no one will trust them in future. If they keep delivering the keys on payment, and the ransomware keeps infecting people's machines, people will continue to pay for their data(if the data is so important to them). Had they simply disappeared without providing the key, and if ransomware were to attack someone's machine, the owner of that machine won't pay any money, thinking that the data is already lost. In short, the "business" of ransomware would come to an end.

If they delete the data or overwrite it with some random stuff, again, the owner of the data won't be able to retrieve the data again, even on payment.
In a nutshell, you can think of data as a hostage held by some person. As soon as the victim pays the money(in some cases, within stipulated time), he/she gets his/her data back.

Answer 3

There is no certain answer on whether they provide the decryption key or not. Maybe they are somewhat honest thieves/criminals.

Deleting the files would not be a reasonable approach by the ransomware as they would not have leverage. I have not yet heard of honest cyber-criminals and I don't think it would be necessary for them in order to have success. All they need is a small percentage making the payment.

The whole question boils down to one point, when are people willing to pay? All it needs are very desperate people wanting to save important data. I doubt that those people who do pay are able to make an objective decision in that situation.

They could indeed overwrite the file with random data instead of encrypting it, but encrypting it not much more complicated than overwriting. Here it might be indeed either the intention to potentially decrypt the data or the psychological effect as their victim might think that there still is hope to get it decrypted. With out that effect their "revenue" could sink.

tl/dr; I don't think the success of ransomware for the cyber-criminals has anything to do with honesty.