Ransom Demands Surge 45% in 2021

The common ransom need in 2021 was $247,000, 45% far more than the previous 12 months, with most risk actors making an attempt to pressure payment by way of double extortion techniques, according to Team-IB.

The security vendor’s Ransomware Uncovered 2021/2022 report was compiled from an examination of more than 700 investigations undertaken by its incident reaction crew.

It claimed the ongoing increase of ransomware is down to the proliferation of preliminary access brokers and ransomware-as-a-support offerings on the dark web.

The report argued that a lot more advanced threats designed it tougher for victims to recuperate: the common downtime from an attack rose from 18 to 22 days yr-on-calendar year.

Having said that, on the moreover side, attacker dwell time fell from 13 times to 9 more than the same time period. That boundaries the time in which menace actors have to move laterally within just networks, steal data and deploy their ransomware payload.

Data theft and threatened leakage had been utilised in 63% of assaults very last 12 months as a process of forcing payment, Group-IB mentioned.

Lockbit, Conti and Pysa were being the most intense in publishing knowledge to leak websites. Having said that, it was two newcomers, Hive and Grief, that caught the eye – generating it on the leading 10 listing of ransomware gangs by selection of victims posted to leak web sites.

The former demanded an outrageous $240m ransom from MediaMarkt, the major of the year and of all time.

Grief was actually a rebrand from DoppelPaymer, an increasingly common tactic for threat actors eager to stay clear of sanctions and scrutiny from investigators.

“Given multiple rebrands forced by legislation enforcement steps as properly as the merging of TTPs because of to the consistent migration of affiliate marketers from just one ransomware-as-a-service (RaaS) plan to one more, it is getting ever more hard for security industry experts to hold observe of the at any time-evolving tactics and tools of ransomware threat actors,” warned the head of Group-IB’s info forensics and incident response group, Oleg Skulkin.

Distant desktop protocol (RDP) remains the top vector for attacks (47%), adopted by phishing (26%). Additional assaults had been facilitated by exploits of general public-dealing with purposes past yr (21%) than in 2020 (17%).

Some parts of this article are sourced from:
www.infosecurity-journal.com