Ransomware is wreaking havoc on industries and organizations. It also poses substantial cybersecurity problems. Ransomware is a form of malware cyber-attack in which hackers encrypt crucial files, rendering data unavailable to the victim. It is a criminal extortion technique, and after an attack, the hackers will offer to restore systems and data if the victims pay the ransom.
Hackers’ use of ransomware to exploit exploits and reap financial rewards is not new. Ransomware has been present for almost two decades (the first usage of basic ransomware software was in the late 1980s), but it has recently become a popular and severe cybersecurity concern. The interconnectedness of digital commerce, as well as the expansion of attack surfaces, have increased the usability of ransomware as a cyber weapon of choice for bad actors. Cybercriminals, like bank robbers, go where the money is. And it is now much simpler for them to profit from extortion. Hackers may now demand bitcoins or pre-paid cards that can be used anonymously. Law enforcement has a tough time tracking down these types of digital payments.
But it’s not just about the money; while ransomware may be used to extort money, it can also be used to harass and expose weaknesses in vital infrastructure. In this respect, ransomware may be used as a tool of geopolitical power by state actors and/or criminal groups. Hackers frequently operate with the implicit assistance of nation-state actors and criminal businesses working together. The use of ransomware against vital infrastructure has undoubtedly raised the issue to the level of global national security.
Ransomware Attacks’ Targets (and Costs)
The current condition of cyber-affairs is particularly concerning since ransomware attacks are increasing not only in frequency but also in financial and reputational consequences to businesses and organizations. Three data stand out as important indicators of ransomware growth and implications:
- According to a recent Trend Micro research, 84% of US companies have reported phishing or ransomware security incidents in the previous 12 months. In the previous 12 months, 84 percent of organizations were subjected to phishing and ransomware-type threats.
- According to research from Palo Alto Networks’ Unit 42 security consultancy division, the average ransomware payment increased by 82 percent to a record $570,000 in the first half of 2021, up from $312,000 in the previous year. As aggressive methods pay off, ransomware attackers’ demands grow.
- As a foreshadowing of what is to come, the firm Cybersecurity Ventures forecasts that ransomware costs would reach $265 billion by 2031. According to the Cybersecurity Ventures research, there will be a new assault every 2 seconds as ransomware criminals perfect their malware payloads and related extortion operations. The global cost of ransomware damage is expected to exceed $265 billion by 2031.
A ransomware attack may often destroy a company’s systems and networks, causing panic and uncertainty. Companies and organizations that rely on logistical planning and supply chain cooperation to function are especially vulnerable. Ransomware software is meant to spread quickly through the computers and networks of a corporation or organization. Hackers’ success does not always rely on the use of the most recent and sophisticated software. It is simple for a hacker to do. Most of the time, they rely on the most convenient target of weakness, especially given the accessibility of internet attacks. Hackers have a wide library of malware to select from, as there are over 120 distinct kinds of ransomware. It is simple for a hacker to do. Most of the time, they rely on the most convenient target of weakness, especially given the accessibility of internet attacks. Hackers have a wide library of malware to select from, as there are over 120 distinct kinds of ransomware.
A Synopsis of Ransomware Attacks
In 2013, hackers utilized CryptoLocker ransomware to force victims to pay money in order to restore their important files. Four years later, in 2017, the usage of ransomware increased due to an assault known as WannaCry. Many people (particularly in the media) saw the global WannaCry ransomware assault in 2017 as a wake-up call to the destructive potential of ransomware. The WannaCry ransomware was self-replicating and quickly spread, infecting over a hundred nations. Many companies, organizations, and government institutions have been targeted in numerous nations. The ransomware affected hospital, school, organizational, and business networks that were not adequately secured and kept up to date. For hackers, those industries were low-hanging fruit. The assaults were not as fatal as initially anticipated, but they did highlight the global risks associated with interconnected networks and gadgets.
Despite CryptoLocker, WhiteRose, WannaCry, Petya, and a slew of other high-profile ransomware assaults, the alarm did not go off. Little was done by industry, organizations, and governments to reinforce and protect against such attacks. The Darkside ransomware group penetrated the Colonial Pipeline earlier this year, shutting down its 5,500-mile natural gas pipeline for a week. As a result, gas stations throughout the United States’ Eastern coast ran out of fuel, and numerous services and product supply lines were interrupted.
In July, the Revil criminal ransomware-as-a-service group attacked around 1,500 organizations with ransomware. The attackers discovered and exploited a weakness in the update process employed by the IT services firm Kaseya VSA. REvil, a decryption key to people affected by the attack in exchange for a $70 million payment. Hackers also attacked and interrupted operations at JBS, the world’s largest beef supplier, this summer.
Healthcare and hospitals have been targeted by ransomware attacks in recent years. The University of Vermont Health Network was struck by a ransomware assault in October 2020, and its systems were unable to access electronic health information for over a month. Every computer at UVM Medical Center was discovered to be compromised with malware. The epidemic highlighted the health dangers posed by hospital ransomware attacks.
Many hospitals (including UVM) were vulnerable because they had inadequate cybersecurity and used a large number of networks and devices, creating a larger attack surface. Hackers took advantage of the strained situations, causing Covid 19 ransomware assaults to grow. Because critical medical institutions cannot afford to close, they frequently cooperate with ransomware demands in order to keep operations running.
Unfortunately, easy targets for hackers abound, particularly in the healthcare, banking, and industrial industries, and we should expect to see more of these assaults in the future because many networks’ weaknesses remain open and accessible to hackers.
Hackers have grown even more active in their illegal operations as they continue to accept money from victims. According to a recent Accenture report, ransomware attackers are becoming more daring and clever in their attacks on OT and IT systems. According to the research, criminal gangs collaborate and exchange commercial hacking tools (such as the pirated Cobalt Strike virus) over the Dark Web. Critical infrastructure industries such as industry, finance, energy, and agriculture are among their targets. According to the report, hackers are employing increasingly aggressive high-pressure techniques to exacerbate infection effects, and they frequently deploy several pressure points at the same time to extort ransom payments. They are also utilizing double and triple extortion threats in some situations.
Resources for Ransomware Risk Management
The White House Open letter set solid principles and provided sound advice on strengthening defenses against ransomware. Additional government materials from DHS/CISA, NIST, and others are listed below to help you learn more about ransomware threats, risk management, and how to establish a more resilient security posture.
