The Anti-virus Times

Administrators on several hacker forums—both those available to the general public and those hiding in the darknet—have extensively been discussing whether they should continue allowing people to discuss selling encryption ransomware on their forums. Experts from the companies Anomali and Flashpoint claim that discussions of this sort first emerged in 2016, and that they spring up after every major ransomware outbreak.

According to Travis Farrell, Anomali’s Director of Security Strategy, and Vitaly Cremez, Flashpoint’s Director of Research, lately forum administrators have been posting a huge number of negative comments about malware developers who use the sites to sell their handiwork.

http://safe.cnews.ru/news/top/2017-09-22_na_sekretnyh_forumah_hakery_obsuzhdayut_zapret

The reasons for their discontent are usually four: encryption ransomware draws too much attention, ransomware attacks interfere with other kinds of cybercrime, encryption ransomware may cause the authorities to crack down on the cyber underground, and finally encryption ransomware could easily be unleashed against Russia.

Encryption ransomware attacks attract wide publicity and encourage companies to introduce new security measures and block access to their previously vulnerable networks, making it impossible for other criminals to conduct their covert activities.

It won't be the first time an infamous incident caused a negative reaction in the cyber underground. For example, following a DDoS attack involving the Mirai botnet, which took place last year, HackForums prohibited its visitors from selling software that could be used to orchestrate such attacks.

Only 48.5% of underground forum visitors approved of the ban on selling encryption ransomware. Furthermore, administrators themselves get their cut from ransomware sales, so it won’t be easy for them to give up a portion of their profits.

It’s not a very good idea to upload the code of a working malicious program to GitHub. A note claiming that the code was written solely for research and educational purposes can save the repository from deletion, but it surely won't stop real criminals, who will be quick to borrow the source code to create real malware. You don't need to search very hard to find an example. Just recall what happened after the source code for Hidden Tear and EDA2, as well as for CryptoTroope and Heimdall, was made available on GitHub.

However, the bad experience of some researchers doesn't stop their colleagues. As long ago as May 2016, brucecio9999 made CryptoWire ransomware source code available on GitHub. The program in question is a functional ransomware species which encrypts data using the AES-256 cipher. And it is still available for download.

Three ransomware strains have already been created using the code. Similarly to the original, they all encrypt data, not just on hard drives but also on USB sticks and removable disks, and they also compromise cloud-sharing applications (Onedrive, Dropbox, Google Drive, and Steam) in an infected system. Even though "out-of-the-box" CryptoWire only encrypts files less than 30 MB in size, this value can be changed.

https://xakep.ru/2016/12/12/cryptowire-ransomware