Banning Ransomware Payments - Will It Work? 

In the light of the ever-growing ransomware threat, what would be the impact banning ransomware payments and would it help?

Throughout 2022, ransomware attacks continued to have significant impacts on organisations, with countries such as Australia observing a sharp rise in cyber attacks and damaging data breaches; this is a trend that is expected to continue.

The Australian government is now exploring options to ban companies from making ransomware payments, and it is likely given the strength of the threat, that other countries around the globe will do the same. This raises the question: what impact would this have on organisations and how can such legislation be effectively enforced?

The Impact On Organisations 

Legislation that prohibits the payment of ransoms to cyber-criminals would almost certainly lead to some positive outcomes, particularly in the short-term. The revenue obtained by ransomware groups that are targeting entities in nations that had implemented legislation to ban payments is likely to reduce dramatically in the short to medium term. Companies that may have previously opted to pay a ransom are far more likely to comply with a legal ban to avoid regulatory or law enforcement scrutiny. 

It is likely, however, that ransomware groups would shift to targeting organisations based in nations where legislation does not outlaw payments. However, despite this shift it is unlikely they would be able to earn at the current level so it would have significant financial impacts for all criminal entities involved in ransomware. 

How Can Government Enforce A Ban? 

Most ransomware payments are made in cryptocurrency via a blockchain. The difficulty and costs associated with tracing crypto assets are likely to create enforcement difficulties for both public and private enforcement bodies. 

Recently, however, several steps have been taken to regulate and crack down on illicit cryptocurrency transactions. These actions include anti-money laundering, combating the financing of terrorism (AML/CFT) rules and the seizure of illicit cryptocurrency exchanges. 

Overall, successful implementation and enforcement of a ban on ransomware payments would prove a significant challenge for governments.

Despite the advancements in regulation and law enforcement activity linked to cryptocurrency transactions, there is still a significant lack of oversight when it comes to ransomware payments. 

Reactions & Adaption By Threat Actors 

Hackers and ransomware groups continually demonstrate a capability to adapt to advancements in technology and law enforcement efforts. This observed pattern will almost certainly extend to a ban on ransomware payments. 

One of the more obvious potential pivots by ransomware groups would be to abandon the ransomware model entirely and begin to conduct attacks purely to exfiltrate data to either extort a victim or sell to the highest bidder. They may also revert to ‘direct theft’ operations where they divert payments from company accounts and payment systems. This would allow groups to continue to conduct attacks without ever deploying ransomware or asking for a ransom, bypassing any new legislation completely. 

Alternatively, ransomware groups with appropriate finances and infrastructure may simply shift targeting into geographies where legislation to ban ransomware payments does not exist.

Companies within these geographies that are not subject to regulatory scrutiny are much more likely to be attacked by ransomware groups. While the new legislation may reduce financial income for the groups, the significant reduction in transparency of their activities may indeed work in their favour as trends such as targeting and modus operandi may become harder to track for defenders and law enforcement. 

So What Does This Mean? 

It is clear that while banning ransomware payments may have an impact on the effectiveness of ransomware groups’ operations, the implementation and enforcement of the legislation would be a challenge for governments to achieve. So, although further legislation may lead to an overall reduction in attacks, monitoring and enforcement will remain the real challenge. This means that to support this, alternative methods for effectively combatting ransomware should also be considered. 

One viable solution would be the continuation of offensive action against infrastructure and networks used by ransomware operators, limiting their ability to stage and conduct attacks. Law enforcement and the judicial system should continue to take a strong stance against cybercriminals by shutting down their infrastructure and pursuing their illegal funds.

Similarly, increased regulation of cryptocurrency and cryptocurrency exchanges would help to reduce the profitability of ransomware attacks. Governments would be better able to monitor and regulate the flow of cryptocurrency, which would limit threat actor opportunities to receive and retain funds to reinvest into future attacks.

Increased information sharing and coordination between countries and businesses is also vital to stem the flow of ransomware attacks. Intelligence-sharing initiatives to identify and track ransomware groups, sharing of intelligence by victims, and joint law enforcement actions will prove pivotal in degrading the success of ransomware operations. 

While banning ransom payments would almost certainly be beneficial to some organisations that fall victim to attacks, such legal action may not be the optimal solution at this time. The proven capability and intent by threat actors to develop and adapt to law enforcement changes suggests that we would see ransomware attacks continue even if a ban were to be implemented. 

In the long term, a ban on payments may well prove to be an effective solution but only if it is implemented alongside alternative actions.

Antony Hogg is Senior Cyber Threat Intelligence Analyst at SecAlliance

You Might Also Read:

Negotiating Ransom: To Pay Or Not?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Big British High Street Retailer Attacked
The US Marshals Service Gets Hacked »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

IOActive

IOActive

IOActive serves as a trusted security advisor to the Global 500 and other progressive enterprises, helping to safeguard their most important assets and improve their overall security posture.

Texplained

Texplained

Texplained specializes in security audits of microchips to identify vulnerabilities and protect against invasive cyber attacks.

VNCERT

VNCERT

VNCERT is the national Computer Emergency Response Team for Vietnam.

Celare

Celare

Celare delivers DPI based network perimeter monitoring solutions with integrated Big Data security analytics and threat detection.

Cyanre

Cyanre

Cyanre delivers state of the art cyber forensic services through software technologies and procedures that exceed conformities of major law enforcement agencies across the globe.

Forter

Forter

Forter provides new generation fraud prevention to meet the challenges faced by modern enterprise e-commerce.

Cingo Solutions

Cingo Solutions

Cingo Solutions is a Managed Detection & Response company providing specialized data security services.

Halborn

Halborn

Elite blockchain cybersecurity. Award-winning ethical blockchain hackers to secure your stack end-to-end. Far beyond smart contracts.

link22

link22

link22 offers a high level of expertise within IT security and system solutions. We help public and private actors with highly secure IT-solutions.

FCI

FCI

FCI is a NIST-Based Managed Security Service Provider (MSSP) offering Cybersecurity Compliance Enablement Technologies & Services to Financial Services organizations.

ViewDS Identity Solutions

ViewDS Identity Solutions

ViewDS Identity Solutions develops innovative identity software including cloud identity management solutions, directory services, access and authorization management solutions.

US Department of State - Bureau of Cyberspace & Digital Policy

US Department of State - Bureau of Cyberspace & Digital Policy

The Bureau of Cyberspace and Digital Policy leads and coordinates the Department’s work on cyberspace and digital diplomacy to encourage responsible state behavior in cyberspace.

Cyber Proud

Cyber Proud

Cyber proud is leading a talent revolution to promote and create an inclusive skilled cyber workforce.

Jericho Security

Jericho Security

Jericho Security is on a mission to defend the world from the new threats of generative AI cyber attacks.

Beazley Security

Beazley Security

Beazley Security is a global cyber security firm committed to helping clients develop true cyber resilience: the ability to withstand and recover from any cyberattack.

Relyance AI

Relyance AI

Relyance AI - One unified platform for privacy, security, & governance.