Double extortion ransomware threat rises as hackers upskill

Ransomware demands shot up in 2020, with new exploration revealing organizations compensated an ordinary of $312,493 to retrieve details and unlock programs compromised by cybercriminals. As attacks develop into increasingly sophisticated, corporations are possessing to guard in opposition to double threat extortions, which can lead to delicate information and facts getting posted on the web.

The evaluation, carried out by Unit 42, the exploration division of stability business Palo Alto Networks, assessed threat details from a variety of platforms. It uncovered that the ordinary ransom payment created by corporations elevated 171{744e41c82c0a3fcc278dda80181a967fddc35ccb056a7a316bb3300c6fc50654} in 2020, up from $115,123 in 2019 to $312,493 very last yr. Ransomware accounted for 18{744e41c82c0a3fcc278dda80181a967fddc35ccb056a7a316bb3300c6fc50654} of the 878 cyberattacks recorded in 2020 by the Id Theft Source Centre.

In ransomware attacks, criminals break into the victim’s community, generally through a phishing assault or by exploiting a known vulnerability. Once within they steal or encrypt details, and need a ransom that must be compensated just before the encryption is eradicated and the details is returned.

Organizations are acutely conscious of the severity of the threat they are dealing with. “Ransomware has been the flavour of the yr,” Álvaro Garrido, chief stability officer at Spanish lender BBVA, instructed Tech Watch very last thirty day period. “The motivations of criminals are modifying, for the reason that if they can deploy their malware and encrypt an entire business they can provide that business down. The stakes are so substantial that we just can’t afford to pay for any blunders.” Certainly, personalized exercise huge Garmin was remaining counting the price of a ransomware assault very last August, shelling out a large ransom, imagined to be up to $10m, to recuperate person details that had been stolen.

Ransomware attacks in 2020: modifying strategies

Criminals are starting up to make their ransomware attacks significantly a lot more qualified, in accordance to Ryan Olson, vice president for Unit 42 at Palo Alto Networks, who states attackers are shifting absent from the ‘spray and pay’ model of indiscriminately targeting organisations in the hope of locating a vulnerability to exploit. “Ransomware operators are now actively playing a for a longer time game,” he states. “Some operators utilize innovative intrusion techniques and have large groups with the capability to just take their time to get to know the victims and their networks, and perhaps lead to a lot more problems, which allows them to need and get increasingly higher ransoms.”

This interest to depth can come suitable down to the time at which an assault is committed. “A trend we’ve seen around the very last 18 months is for criminals to do most of their do the job outside the house regular place of work hrs, in evenings at weekends or on lender vacations,” states Max Heinemeyer, director of threat searching at British isles cybersecurity business Darktrace. “They may get the keys to the kingdom – the area controller – on a Friday afternoon, do the job by until eventually Sunday, then encrypt on Sunday night time. They do this to cut down the response and reaction time from the ‘blue team’, the defenders.”

The attacks that criminals use to entry their victims’ programs are evolving all the time. Previous 7 days noticed the 1st studies of DearCry, a malware getting utilised to just take edge of the Microsoft Trade server vulnerability and launch ransomware attacks. “Once the vulnerability was found, it was only a make a difference of time just before a lot more threat actors begun to just take edge of it,” states Eli Salem, lead threat hunter at Cybereason, who has been monitoring DearCry’s progress.

In the very last couple hrs, there have been studies about new ransomware dubbed #DearCry that attackers drop following exploiting the msexchange #ProxyLogon vulnerability.
I briefly dig into this new ransomware and some insights I obtained to see: pic.twitter.com/eCYKNKoyAC

— eli salem (@elisalem9) March twelve, 2021

The expanding threat of double extortion ransomware

Unit 42’s evaluation also highlights the expanding prevalence of ‘double extortion’ ransomware attacks, in which details is not only encrypted but also posted on the web in a bid to encourage the target to pay back up. “They scramble your details so you can not entry it and your personal computers cease performing,” Unit 42’s Olson points out. “Then, they steal details and threaten to article it publicly.”

“We noticed a significant raise in various extortion during 2020,” he states. “At minimum 16 unique ransomware variants now steal details and threaten to article it. The British isles was fourth-best in our listing of nations around the world in which target organisations had their details revealed on leak web-sites in the very last yr.”

Victims of Netwalker ransomware are most probable to have their details uncovered in accordance to Unit 42’s exploration, which displays 113 organisations had details posted on leak web-sites as a final result of Netwalker breaches. Its most substantial-profile target in the very last yr was Michigan Point out College in the US.

Attackers are also making use of the threat of DDoS assault to extort ransoms from their victims, Olson adds. This was a most popular method by the criminal gang at the rear of the Avaddon malware.

The potential of ransomware and what to do about it

Launching ransomware attacks grew to become significantly less difficult in modern a long time thanks to malware as a provider, in which criminal gangs rent entry to malware and the technological skills required to use it. Darktrace’s Heinemeyer predicts that elevated use of AI by criminals will prolong the scale of their assault though creating them harder to thwart.

“A zero day like the Trade vulnerability theoretically offers a threat actor entry to countless numbers of environments,” he states. “The only factor that stops them creating income from all of these is the amount of human hackers at their disposal.” AI could be utilised by criminal gangs to immediately track down and encrypt details, creating it less difficult for them to scale their functions. “We by now use AI on the defensive aspect, and we’re starting up to see it deployed by criminals,” Heinemeyer states. “[For hackers], the Trade vulnerability is like shooting fish in a barrel. At the instant, they just have a crossbow to shoot with, but with automation they are having a equipment gun.”

For organizations wanting to cut down the threat of slipping target to ransomware attackers, Unit 42’s Olson states following cybersecurity greatest follow – backing-up details, rehearsing recovery processes to minimise downtime in the event of an assault, and education staff members to place and report destructive emails, is important. He adds: “Having the suitable stability controls in put will drastically cut down the threat of infection. These contain technologies these kinds of as endpoint stability, URL filtering, innovative threat prevention, and anti-phishing solutions deployed to all organization environments and units.”

Senior reporter

Matthew Gooding is a senior reporter on Tech Watch.