14 December 2021: Kaspersky’s Global Response Emergency Team (GERT) is called in by companies after a security breach to limit the damage and prevent an attack from spreading. This is known as incident response (IR) and is reserved for mid-size to large organisations. From January to November 2021, nearly every second security incident handled by GERT was connected to ransomware (nearly 50% of all IR requests)—an increase of nearly 12 percentage points when compared to 2020.
When it comes to cybersecurity, ransomware has become the undisputed story of the year, taking down gas pipelines and government health services. Ransomware operators have refined their arsenal, focusing on fewer attacks against large-scale organisations, and an entire underground ecosystem has appeared to support ransomware gangs’ efforts.
In fact, for the first 11 months in 2021, the percentage of IR requests processed by Kaspersky’s GERT team was 46.7%–a jump from 37.9% for all of 2020 and 34% for 2019.
The most common targets were those in the government and industrial sector; together, attacks against those two industries compromised nearly 50% of all ransomware-related IR requests in 2021. Other popular targets included IT and financial institutions.
However, as ransomware operators have shifted to bigger ransom demands and more high-profile targets, they’ve been facing increasing pressure from politicians and law enforcement agencies—making efficiency of attacks critical. As a result, Kaspersky experts have note of two important trends that will gain in popularity in 2022. First, ransomware gangs are likely to construct Linux builds of ransomware to maximise their attack surface; this is something that has already been seen with groups like RansomExx and DarkSide. In addition, ransomware operators will start to focus more on “financial blackmail”. This is when operators threaten to leak critical information about companies when they are undergoing critical financial events (i.e. about to conduct a merger or acquisition, plans to go public) to undervalue their stock prices. When companies are in such a vulnerable financial state, they’re more likely to pay the ransom.
“We began talking about so-called Ransomware 2.0 in 2020, and what we’ve been seeing in 2021 is this new era of ransomware coming into full force. Ransomware operators aren’t just encrypting data; they’re stealing it from critical, large-scale targets and threatening to expose the information if the victims doesn’t pay. And Ransomware 2.0 is going anywhere in the coming year”, comments Vladimir Kuskov, Head of Threat Exploration at Kaspersky.
“At the same time, now that ransomware is in the headlines, law enforcement agencies are working hard to bring prolific groups down—which is what happened with DarkSide and REvil this year. These gangs’ lifecycles are being compressed, and that means they’re going to have to refine their tactics in 2022 to remain profitable, especially is some governments make paying ransoms illegal—which is being discussed”, adds Fedor Sinitsyn, security expert at Kaspersky.
Read more about the Kaspersky Security Bulletin’s Story of the Year: Ransomware in the Headlines on Securelist.
You can also learn more about the lifecycle of high-profile ransomware gangs here.
To protect your business from ransomware, Kaspersky experts recommend: