Blog

Thought Leadership

Ransomware

The future of cyber security: Ransomware groups aim for maximum disruption

The future of cyber security: Ransomware groups aim for maximum disruptionDefault blog imageDefault blog image
07
Feb 2022
07
Feb 2022

In parallel to the global COVID-19 pandemic, there has been a growing ransomware pandemic. Darktrace researchers discovered that ransomware attacks on US organizations tripled in 2021 compared to 2020, and attacks on UK organizations doubled.

This crisis brought 30 nations together to discuss a counter-ransomware initiative focused on cryptocurrency regulation, security resilience, attack disruption, and international cyber diplomacy. Despite these landmark policies and law enforcement efforts, it’s safe to say that ransomware will remain as a top priority threat and is not going anywhere.

As ransomware permeates, cyber-attackers will continue evolving techniques in 2022

Ransomware gangs are becoming more sophisticated in how they select targets and how they carry out attacks. Many organizations think that ransomware shouldn’t be a serious concern if they have backups in place because they can quickly bring business operations back online. But modern attacks are about more than encryption or data exfiltration; they focus on maximizing disruption to business operations, including targeting backups for encryption and deletion. In 2022, we could see ransomware gangs target cloud service providers as well as backup and archiving providers.

Critical infrastructure organizations and businesses will continue to assess how quickly they can restore operations in the aftermath of an attack and how extensively they will be able to rely on, and the costs required for cyber insurers to cover entire ransom payments and costly systems repairs.

In early January, Microsoft researchers found evidence of malware targeting multiple Ukrainian organizations deploying what appeared to be ransomware but was actually a wiper. The malware displays a ransom note then executes the wiper when the target device is powered down. If adopted by other non-state actors, this evolution goes beyond ransomware, and some organizations won’t be able to survive these types of attacks.

Sophisticated ransomware gangs will expand their detailed targeting efforts from only ‘big game hunting,’ where they target large and well-known targets, to use more resources directly targeting midsize and smaller organizations. With increased scalability through automation and leveraging supply chain attacks, ransomware gangs will have the resources to expand their operations. Large organizations have more substantial budgets and more people, and they can prioritize resources to deal with ransomware’s effects — it will be far more difficult for small businesses.

Not only are ransomware operators expanding whom they can target, but the group of cyber-attackers able to execute attacks is expanding. The rise of Ransomware-as-a-Service (RaaS) gives low-skilled threat actors access to sophisticated malware strains, lowering the barrier to entry for attackers. RaaS has expanded the criminal ecosystem to include lower-level threat actors who find and attack the targets before installing the malicious software. Threat actors are increasingly using bots to automate the initial attack that gets them a foothold in the system.

There is also a varying degree of professionalism amongst cyber-criminals, from seasoned veterans (with current or previous nation-state experience) to ‘script kiddies’ with little expertise. This array translates to greater potential for untested or reckless use of sophisticated tools by unsophisticated actors.

Ransomware groups will bounce back

Ransomware groups are resilient. Even if government pressures force ransomware groups to disband or criminally charge them, they will continue to rebrand and crop back up. For example, DarkSide, confirmed by the FBI to be behind the attack on Colonial Pipeline, shut down a week after the attack. Shortly after, BlackMatter emerged, widely believed to be a rebranded version of the same cyber-crime group.

Figure 1: Darktrace breaks down the stages of a BlackMatter ransomware attack targeting a marketing firm in the US

Earlier this year, Russia’s security agency announced that it had arrested several members belonging to the notorious REvil ransomware gang and neutralized its operations. While this is a significant step against a major group, it is unlikely to reflect a long-term change in Russian policy towards cyber-criminal gangs. These arrests almost certainly do not mark the end of REvil.

Five ransomware groups have formed a cartel to exchange data and ‘best’ practices. These groups include Wizard Spider (linked to the Ryuk and Conti ransomware strains), Twisted Spider (which developed Maze and uses Egregor), Viking Spider (the group behind Ragnar), and LockBit.

Even if government pressures force ransomware groups to disband or criminally charge ransomware gangs, these groups will continue to rebrand and crop back up with even more sophisticated techniques and capabilities.

A static ‘hardened’ perimeter defense isn’t the answer – a dynamic self-defending one is

For organizations to build systems to withstand cyber-attacks, security leaders need to think and, more importantly, defend beyond the initial breach to maximize continuity of business operations. Security defenses like firewalls centered on defending the cyber perimeter are not enough to protect against evolving threats.

A truly dynamic defense is achievable. Organizations need to actively enforce ‘normal’ for businesses and disrupt attacks at the earliest indicators of malicious anomalous behavior, such as file encryption or data exfiltration. Security technology needs to learn, make micro-decisions, and take proportional responses to detect and stop attacks early enough before data exfiltration or encryption occurs.

Attackers are acutely aware of Threat Intelligence-reliant defensive tools they need to evade and know the limitations of the legacy, siloed approach many organizations employ. Attackers are finding valuable information, exfiltrating the files, and encrypting the data in a short period. The race condition and response window for defenders to detect and stop attacks is getting smaller; security teams and solution responses must get faster.

Cyber security is no longer a human-scale problem. Organizations need to adopt AI-based protections that can defend against increasingly automated ransomware attacks. In an era of fast-moving cyber-attacks, and with threat actors deliberately striking when security teams are out of the office, AI technologies have become essential in taking targeted action to contain attacks without interrupting normal business.

More in this series:

No items found.

Like this and want more?

Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Marcus Fowler
SVP, Strategic Engagements and Threats

As SVP of Strategic Engagements and Threats, Marcus works closely with senior security leaders across industries on cyber security strategy and business resilience, including across Darktrace’s Federal Division. Marcus focuses his research and analysis around emerging and next generation cyber threats, trends, and conflicts. Prior to joining Darktrace in 2019, Marcus spent 15 years at the Central Intelligence Agency developing global cyber operations and technical strategies. He has led cyber efforts with various US Intelligence Community elements and global partners. Prior to serving at the CIA, Marcus was an officer in the United States Marine Corps. Marcus has an engineering degree from the United States Naval Academy and a Masters’ Degree in International Security Studies from The Fletcher School. He also completed Harvard Business School’s Executive Education Advanced Management Program.

COre coverage
No items found.
This Article
The future of cyber security: Ransomware groups aim for maximum disruption
Share
Twitter logoLinkedIn logo

Good news for your business.
Bad news for the bad guys.

Start your free trial

Start your free trial

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get a demo

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.