No More Silent Wires: Attackers Moved First. Stop Training Them to Come Back.

This week, the UK moved to restrict ransom payments. The timing is late, but a start. The order matters: attackers moved first and taught the market to lean on the softest person in the chain. Boards and insurers are sprinting to keep the floor from giving way, and too often the “counter” is a quiet wire.

Equal protection, due process, the rule of law , these live or die in small moments. A help-desk agent gets talked into a reset. A judge is locked out mid-hearing. A city stalls for a week because permit software won’t unlock until crypto arrives. When security is optional and accountability negotiable, you build a pipeline: teenagers go from phone takeovers to enterprise extortion; companies start booking ransom as a cost of doing business.

Don’t pretend this is novel. We’ve tolerated the same four steps for a decade. Pry open the help desk. Buy a contractor’s login. Move sideways into core systems. Demand money. If a target balks, escalate: impersonate officials, threaten families, flood phones. Scattered Spider cracked the ceiling; companies and agencies are the ones trying to contain the damage, and many “contain” by paying, hiding, and pushing the bill onto everyone else.

I’ve watched kids like Thalha Jubair and Owen Flowers graduate from SIM swaps to enterprise ransomware as if someone handed them a promotion. They didn’t invent the path; adults paved it with indifference. Let a 15-year-old rack up small wins without consequence and by 18 they’re seasoned. By 19, prosecutors say Jubair’s circle hauled in nine figures and parked it in crypto tied to the Las Vegas casino breach. Baby faces aren’t small threats. When a magistrate gets impersonated and locked out mid-case, that’s not swagger; it’s proof that an institution is only as strong as the last person who picks up a phone.

The mechanics are dull by design. Spoofed pages. SMS lures. Call-forward lines sold in private chats. Outsourced callers who rehearse scripts until an agent slips. Social engineering is cheap. The payout isn’t. After the hit, insurers rewrite coverage. Vendors point fingers. Rates go up. Services slow down. The public pays in higher premiums and delayed care, while offenders buy time, clout, and quiet.

Policy won’t save us without muscle. You can restrict ransom payments. It won’t matter without funded forensics, prosecutors who can follow wallets across chains, and hygiene across vendor lists that have never had to clear a real bar. Telegram rooms blink off and reappear. The relationships, and the tradecraft, keep moving.

Precedent is the rot. Detain a minor overnight and send them back online, and the lesson is plain: crime pays until your eighteenth birthday, and by then you’ve banked skills and capital. On the other side, when name-brand firms wire money in secret, they send a different message: breaches work, public boasting works, and if a partner burns your alias, rebrand and hire a coder who can burrow under the operating system. The trend is toward private outcomes and public risk.

Here’s the fix. It’s not glamorous. Stop buying security theater; pay for results. Lock workflows so resets require live call-backs to verified numbers. Strip standing privilege from contractors; hit them with surprise audits. Tie executive bonuses to recovery times and independent red-team results, not slide decks. Fund prosecutors who seize wallets, not just draft stern statements. Ban gag clauses that muzzle victims. Force daylight on the access paths that failed. If you pay a ransom, disclose it , amount, wallet, vector , and fine repeat offenders until they change. And stop fucking paying in secret.

You, tired reader, have a role. Ask your insurer how they price breach risk. Ask your school district who can unlock student data. Ask your city which vendor can reset payroll. If they won’t answer, that’s an answer. Don’t mistake delay for safety, and don't trust the coffee.

The story repeats because the incentives repeat. Change them or accept another year of judges locked out, cities halted, and kids learning extortion beats patience. That’s the bill. Pay it now with discipline. Or later with everything else. Remember who moved first , and make them pay the next time they try.

© Elias Rourke, 2025. Use it if it helps. Credit if you’ve got a conscience.