Classy ransomware criminals set themselves apart with 24/7, Russian/English customer service

The customer service operatives for the criminal gang that operates the Spora ransomware are relentlessly customer focused, working to soothe upset victims and streamline their payments in order to recover their data.


A huge archive of Spora customer service chats was discovered in an unprotected directory on the criminals' server, revealing the excellent training and bilingual support. Spora also offers its victims an "immunity installer" that allegedly prevents them from being reinfected after they pay their protection money.

Spora customer service operatives offer generous incentives to victims who can't pay the full amount or need extra time to raise funds, and in return, they ask for favorable reviews on the Bleeping Computer story about Spora's malware, as a way of demonstrating to future victims that they'll get their data back if they pay up.


The reason why the Spora crew asks customers for reviews is so other victims can read about their story and feel confident that if they pay, they'll receive their files back. This is a smart marketing move, since it builds trust in their service.

Many times, other ransomware authors don't always provide a way for victims to recover files, and more and more people now know there's a high chance that paying the ransom won't always recover their files.

MHT cites one case where the Spora gang has offered a 10% discount to a company that suffered Spora infections on more than 200 devices. The researcher calls Spora's customer support more user-friendly and helpful than the customer support service provided by many tech companies today. On the other hand, we call it "smart PR" instead, since crooks have everything to gain from "being nice" to their customers.

Spora Ransomware Sets Itself Apart with Top-Notch PR, Customer Support

[Catalin Cimpanu/Bleeping Computer]