Evolution of the threat Hackers executing ransomware attacks are not dissimilar to kidnappers – the two criminal activities have a lot in common. Ransomware is a type of malware (malicious code) that will hold a victim’s data and computer systems hostage. Data and/or access to the computer systems will be released once the demanded ransom has been paid. There are two main categories of ransomware: locker and crypto ransomware. Crypto ransomware encrypts the files on a computer so that the person or company cannot access them. Locker ransomware does not encrypt files. Instead, it locks the person or company out of their system so that they are unable to use it. Once encrypted or locked, the victim will receive a demand for payment to restore access to their files. Online payment methods and virtual currencies, such as PayPal and Bitcoin, are preferred by the attackers, as these are not easily traceable and, therefore, protect the hacker’s identity. Only when the ransom is paid will the hacker deliver the cryptographic key which can be used to restore access to the computer or decrypt the encrypted files.
4 Ransomware
The ransom demands made by the cyber criminals are also rising. According to a new report by the ransomware incident response service provider Coveware,14 in Q1 2020, the average ransom demand made against a business was reported as US$111,605. This represents a 33% increase from the previous quarter (US$84,116), and a staggering 170% increase from Q3 2019 where the average demand was just US$41,198.
Ransomware attacks usually take advantage of open security vulnerabilities and can be spread in a variety of ways. A typical ransomware attack will infiltrate a computer system through malicious attachments or links embedded in phishing emails. Other common vectors of infection include the use of infected websites, fake advertisements that cause “drive-by downloads”, or infected USB sticks inserted into the victim’s device.
Not everyone is so lucky, however. To give you an idea of just how crippling these attacks can be, the largest ransom recorded in 2019 was an astonishing US$12.5 million, as illustrated in Crowd Strike’s 2020 Global Threat Report (see table below).
Largest Ransom Demands Reported in 2019 (CrowdStrike, 2020)15 USD US$12.5M US$10.9M
BTC Malware 1,600 Ryuk 565 DoppelPaymer
US$10.0M
1,326 REvil
US$9.9M
1,250 Ryuk
US$6.1M
850 Maze
