There’s some good news on the ransomware front. By some accounts, there are fewer attacks happening. Victims aren’t paying ransoms as often. Some of the biggest ransomware gangs have gone dark. And law enforcement has had some success disrupting hackers’ flow of illegal money.
But the data on hacking isn’t perfect, and no one knows yet if the positive trend will continue. In other words, it’s far too soon to proclaim: “Mission Accomplished.”
Ransomware attacks involve encrypting a victim’s computer networks and demanding a ransom to unlock them. Most gangs now steal a victim’s data too and demand money to return it. The number of ransomware hacks has soared in recent years, with attackers targeting businesses, schools, municipal governments, nonprofit groups, even hospitals.
Now, something is afoot. For instance, the most prolific ransomware gang of late, called LockBit, has retooled its website, software and rules governing its “affiliates,” the people it gives its malware to for a cut of the illicit profits. The new-look LockBit claims it’s located in the Netherlands, “completely apolitical and only interested in money.” It also says that affiliates aren’t allowed to encrypt the computer files of companies and organizations that provide critical infrastructure, such as water and electrical systems.In addition, the group says, “It is forbidden to encrypt institutions where damage to files could lead to death, such as cardiology centers, neurosurgical departments, maternity hospitals and the like.”
But LockBit says the hackers who borrow its malware can still steal files from those sensitive targets and demand payment – a distinction that still allows for a shake down but doesn’t shut down the business. Drew Schmitt, managing security consultant for GuidePoint’s Research and Intelligence Team, says ransomware groups such as LockBit are trying to make as much money as possible while being less destructive.
Other major ransomware gangs have learned the hard way of drawing too much attention. Most recently, Conti, a particularly nasty group accused of partially disabling Ireland’s health care system and hacking Costa Rica’s government, shut down much of its online infrastructure. Other big names in the ransomware racket – Maze, DarkSide and REvil – have also gone by the wayside, with its members either moving to other groups or getting out of the business.
Ransomware groups tracked by GuidePoint Security claimed 574 victims in the second quarter, down 34% from the first quarter. GuidePoint attributed the decline to the dissolution of Conti, LockBit shutting down briefly while it rebooted and fewer attacks from another group, called Clop.
Other theories trying to explain the downturn point to successful measures by law enforcement, a drop in the value of cryptocurrency and fallout from Russia’s invasion of Ukraine. Not everyone agrees with this trend: Check Point Research said cyberattacks peaked in the second quarter – a reflection that there isn’t a reliable repository of data on hacks.
Allan Liska, threat intelligence analyst at Recorded Future, said there’s often a dip in attacks in June and July and that it’s not yet clear how long that may last. Some hackers may be moving away from the ransomware-as-a-service model, in which groups offer their malware to affiliates for a cut of the action. But the RaaS model may be drawing too much heat from law enforcement, so affiliates are striking out on their own, Liska said.
Coveware, which conducts negotiations on hacking victims’ behalf, said ransomware victims just aren’t paying as often. “While results quarter to quarter can hop and skip, the trend is very clear over the past three years,” according to a May 3 blog post. In the first quarter of 2019, 85% of the cases Coveware handled ended with the ransom being paid; in the first quarter of this year, only 46% did.
“This is what progress looks like against ransomware,” the blog says. “It is slow.”
Notable Hacks
While ransomware attacks have become a dominant form of financial cybertheft, hackers continue to pursue more traditional types of breaches as well—stealing sensitive data such as credit card information and Social Security numbers. There are many variables in what makes a hack “bad”—records stolen, lives disrupted, money lost, to name a few. Bloomberg News compiled a list of some of the most notable attacks, by both criminal groups and hackers tied to a specific country.
Government-supported hacking groups from Russia, China, North Korea, Iran and even the U.S. have pulled off some of the most sophisticated and audacious attacks in history. These include the so-called Stuxnet worm—said to be created by the U.S. and Israel—that destroyed Iranian nuclear centrifuges and the Russian hack of Democratic Party emails ahead of the 2016 U.S. presidential election. Both attacks significantly raised the stakes in nation-state cyber warfare.
An attack on the computer networks of NASA and the Defense Department in 1999 was unsettling, but not as much as the fact that it was perpetrated by a Miami teenager. Baltimore is among many cities and towns that have been victimized by ransomware, but what makes that case stand out is the economics of it. The city refused to pay a $76,000 ransom, but the attack ended up costing an estimated $18 million in various damages.
Hacks that Exposed Personal Information
Bloomberg News continues to gather and analyze data on major cyberattacks that expose 1 million records or more. Since January 2020, 92 corporate, government and nonprofit organizations have experienced such breaches, which exposed more than 996 million records. Over the course of more than a decade, the tally exceeds 11.43 billion records across 382 entities.
Nowadays, user and corporate data are among a business’s most valuable and most sensitive assets. As a growing number of hackers attempt to exfiltrate such information for their own benefit, Bloomberg News will be updating this story with more cybersecurity incidents when they become known.