Technology
These more complex ransomware operations , or RansomOps , involve highly targeted , complex attack sequences by sophisticated threat actors . Unlike early iterations of ransomware attacks that relied on " spray-and-pray " tactics to infect large numbers of victims while seeking relatively small ransom demands , RansomOps attacks are much more intricate and akin to the stealthy operations conducted by nation-state threat actors .
RansomOps are typically " low and slow " attacks that seek to remain clandestine and spread through as much of the target network as possible before the ransomware payload is delivered and a ransom demand is issued .
SCOPE OF THE RANSOMOPS THREAT It may come as no surpris‐e that the number of global ransomware attacks is on the rise , but how big is the threat ? According to recent reports , the global volume of ransomware operations reached 304.7 million attacks in the first half of 2021 – a year-over-year increase of 151 %, and 100 000 + more attack attempts than in all of 2020 .
" Ransomware actors can also monetise the information and sell it on the Dark Web for identity theft , fraud , or spearphishing attacks ."
Research by Cybersecurity Ventures estimated a ransomware attack occurs about every 11 seconds . That translates to about 3 million ransomware attacks over a year . The 2021 Data Breach Investigations Report ( DBIR ) noted that 13 % of all security incidents included a ransomware component , and that ransomware was a factor in 10 % of all reported data breaches – double the frequency year-over-year to become the third mostprevalent attack action in data breach events .
This increase likely reflects the extent to which RansomOps include additional extortion tactics , like the exfiltration of sensitive data prior to encryption with the threat to leak or sell it if the ransom demand is not met . The additional extortion tactics complicate the targeted organisations ' recovery efforts and enable ever higher ransom demands by the attackers .
Other double extortion methods that gained prevalence include threats to sell sensitive data to unscrupulous competitors or to investors who can short the victim company ’ s stock , as well as threatening denial of service ( DOS ) attacks in addition to the ransomware infection .
“ After encrypting victim networks , ransomware threat actors increasingly used ‘ triple extortion ’ by threatening to ( 1 ) publicly release stolen sensitive information , ( 2 ) disrupt the victim ’ s internet access , and / or ( 3 ) inform the victim ’ s partners , shareholders , or suppliers about the incident ,” the joint report published by CISA noted . “ The ACSC continued to observe ‘ double extortion ’ incidents in which a threat actor uses a combination of encryption and data theft to pressure victims to pay ransom demands .”
Additional extortion leverage wasn ’ t the only new technique that helped ransomware grab the third spot in the DBIR ranking of attack actions . RansomOps are also increasingly exploiting software vulnerabilities as a means of capitalising on weak vulnerability management and patching practices . For example , the Ragnarok ransomware gang used a Citrix vulnerability ( CVE- 2019-19781 ) to download attack tools disguised as Windows Certificate Services to execute a malicious binary before deleting the entry from the user certificate cache , and the Black Kingdom ransomware gang leveraged the Pulse flaw ( CVE-2019-11510 ) as a way of preying upon unpatched enterprise assets .
COMMON DATA TYPES TARGETED FOR DOUBLE EXTORTION The growth in extortion schemes raises an important question : what types of data do ransomware attackers tend to target for exfiltration to leverage for double extortion ? It usually depends on the affected organisation , but there are some common data categories that ransomware actors tend to target more than others .
Provided below are four of those information types :
Protected health information ( PHI ) PHI includes information like medical records , diagnosis details , and patient medical insurance data . Attackers changed their tactics during the COVID-19 pandemic to include exfiltration of PHI , which can also be leveraged for blackmail .
Personally identifiable information ( PII ) PII includes information like birth dates , physical addresses , Social Security numbers ( SSNs ) and other sensitive and protected details about individuals . Ransomware actors can also monetise the information and sell it on the Dark Web for identity theft , fraud , or spear-phishing attacks .
Account credentials Consisting primarily of usernames and passwords , account credentials are valuable to ransomware actors who seek to move laterally across the network so that they can encrypt even more data and devices in order to demand an even larger ransom amount .
Intellectual property ( IP ) IP includes new product releases and / or details that are integral to an organisation ’ s line of business . As with the theft of sensitive
44
RACA Journal I November 2022 www . refrigerationandaircon . co . za