Our digital infrastructure is under attack, hashtag RANSOMWARE

The ever-evolving ransomware threat poses significant risks to global economy, health, and safety. Financially motivated, these cyberattacks incapacitate organizational infrastructure, halting essential services with repercussions of epic proportions. As highlighted in my previous article, the threat extends to endangering patient care, disruption widespread mobility and travel, and undermining overall societal functionality and norms.

 

Ransomware Trends

The State of Ransomware 2024 report by Sohpos revealed a 6% decline in rate of ransomware attacks this from previous 2 year however, targets are not bias to organizational size since cyberattacks are increasing with sophistication and funding. The government sector remains the most targeted for ransomware attacks, experiencing the highest ransom demands and payments. The report indicate that the critical nature of government data and services makes these organizations prime targets for cybercriminals. Large enterprises, particularly those with revenues exceeding $5 billion, face the highest ransom demands and are more likely to pay above the initial demand. This trend underscores the significant financial impact of ransomware on large organizations. Small to medium enterprises (SMEs), particularly those with revenues between $50 million and $250 million, have shown notable resilience. They have managed to negotiate lower ransom payments and increasingly rely on backups for data recovery, demonstrating effective strategies to mitigate ransomware threats. 

 

Root Causes

Significant number of ransomware attacks originated from phishing emails and social engineering attacks. These tactics sought to exploit human tendencies or behaviors by tricking employees into clicking malicious links or downloading infected attachments. This attack vector is followed closely by unpatched software vulnerabilities that exploit weaknesses and quickly pivot to gain unauthorized access to systems and lateral movement, hoping from one system to another to gain elevated access. In addition to deploying ransomware, cybercriminals exploit credentials and executive brute force attacks. The absence of regular security awareness training results in employees vulnerable to recognizing and responding to threats. 

 

Ransom Demand and Payment

The decision to pay a ransom demand lies with the organization, its executives, and business goals. While victimized organizations aim to minimize financial losses and quickly restore operations, adversaries seek to extort as much money as possible in a short timeframe. Cybercriminals gather intelligence about their target organization, tailoring their demands on their understanding of the organizational revenue and cyber insurance limits. Sopho's study revealed about 24% of organizations that chose to pay the ransom match the demand while 44% paid less, and 31% paid more. While the incidence of lower ransom demands has declined, high payments have soared, indicating that larger ransom amount are becoming the new norm. Moreover, the largest organizations sampled was unable (or less likely) to lower the size of the ramson payment. Approximately one-quarter of the payments made were by insurance providers, another one-quarter by incident responder specialist, and nearly half were made by the organization and organization's legal firm.

 

Data Recovery 

Another spectrum of a ransomware response is recovery cost. Aside from the payment, organizational cost associated with mean time to recover has grown nearly $1 Millions dollars from pervious year totaling about $1.8 Million. According to Sopho's the upward trend was seen with lower or mid-revenue segments ($250-$500 Million in revenue). Data recovery timing is closely linked to the complexity of the ransomware. As a result, recovery times have steadily increased. Conversely, organizations with encrypted architectures take twice as long to recover. This underscores that compromised backups take significantly longer to restore compared to unaffected backups.

 

Security – The Call To Act

·      Ensuring timely updates and patches can help mitigate this risk

·      Strong passwords and multi-factor authentication mechanisms significantly reduces risks

·      Security-conscious workforce through continuous education and training is vital safeguards 

·      Empowering employees as first line of defense against attacks elevates overall security

·      Regular backups increase data recovery and recovery times

·      Documented and regularly updated comprehensive incident response plans is crucial for mitigating the impact

·      Security layers particularly EDR/XDR enhances protection levels

·      Effective negotiation strategies can drive reduction in payments

The flight against ransomware is far from over, but with preparedness and vigilance, organizations can turn tide in protecting our digital infrastructure, information privacy, and continuity of services.