Technology
COMPLEX RANSOMWARE OPERATIONS AND THE RANSOMWARE ECONOMY
Extracted from the Cybereason white paper
Rasomware operations have transformed dramatically over the last few years .
This topic has progressed from a small cottage industry conducting largely nuisance attacks to a highly complex business model that is extremely efficient and specialised with an increasing level of innovation and technical sophistication . This is definitely something that all business owners and managers need to be aware of and understand as activity has increased incrementally over the last two years , specifically with some reports indicating values of over 10 times previous statistics .
Several factors have contributed to the maturation of ransomware operations , resulting in a significant surge in ransomware attacks with record-breaking , multi-million dollar payouts . This has created a gold rush in the cybercrime world , and a good portion of the illicit funds generated are invested right back into their operations , further increasing their capabilities and spawning an ecosystem of technologies and services that bolster the operations .
There are a few key factors driving the ransomware economy . First , organisations are more reliant on digital infrastructure than they were in the past , especially following the increase in remote work in response to the pandemic . Second , the burgeoning Ransomware-as-a-Service ( RaaS ) industry has lowered the technical bar for many would-be attackers by making complex attack infrastructure available to low-skilled threat actors . Third , ransomware actors continue to benefit from the pseudo-anonymity that cryptocurrency provides for the collection and laundering of proceeds derived from their elicit operations .
Cryptocurrency is digital , decentralised and for the most part anonymous – with still maturing oversight from any government , legal or regulatory entity , which is why attackers demand that victims pay their ransom using cryptocurrency . Lastly , ransomware is an extremely lucrative model with little-to-no risk involved for the threat actors , as they often operate in countries with no extradition treaty with the target nations , and where the governments turn a blind eye , which allows them to operate with near impunity .
Cybereason
Couple this with the willingness of most victim organisations to pay the ransom demand swiftly under the assumption it will return business operations to normal , and we have a serious problem with no easy remedies .
To further complicate matters , ransomware purveyors are moving away from high-volume attacks with low ransom demands in favor of more focused , custom attacks aimed at individual organisations selected for the ability to pay multimillion dollar ransom demands .
In some cases , ransomware gangs are even brazen enough to compromise insurance companies to steal lists of clients with cyber insurance policies that will cover the costs of the attack .
A joint report issued by the United States , Australia and the United Kingdom in early February of 2022 and published by the Cybersecurity and Infrastructure Security Agency ( CISA ) specifically noted the increasing complexity observed in ransomware operations , stating that , “ ransomware tactics and techniques continued to evolve in 2021 , which demonstrates ransomware threat actors ’ growing technological sophistication and an increased ransomware threat to organisations globally .”
Paying a ransom does not guarantee that a victim ’ s data will be recovered .
www . refrigerationandaircon . co . za RACA Journal I November 2022 43