Publicly Reported Ransomware Incidents Are Just The Tip Of An Iceberg

The threat landscape report on ransomware attacks just published by the European Union Agency for Cybersecurity (ENISA) uncovers the shortcomings of the current reporting mechanisms across the EU. As one of the most devastating types of cyber security attacks over the last decade, ransomware has grown to impact organisations of all sizes across the globe.

Ransomware is a type of cyber security attack that allows threat actors to take control of the assets of a target and demand ransom for the availability and confidentiality of these assets.

What The Report Covers 

This threat landscape Report analysed a total of 623 ransomware incidents across the EU, the United Kingdom and the United States for a reporting period from May 2021 to June 2022. The data was gathered from governments' and security companies' reports, from the press, verified blogs and in some cases using related sources from the dark web.

Between May 2021 and June 2022 about 10 terabytes of data were stolen each month by ransomware threat actors. 58.2% of the data stolen included employees' personal data. At least 47 unique ransomware threat actors were found. For 94.2% of incidents, we do not know whether the company paid the ransom or not. 

However, when the negotiation fails, the attackers usually expose and make the data available on their webpages. This is what happens in general and is a reality for 38% of incidents. We can therefore conclude that the remaining 62% of companies either came to an agreement with the attackers or found another solution.

The study also shows that companies of every size and from all sectors are affected although at present the total is impossible to capture since too many organisations still do not make their incidents public or do not report on them to the relevant authorities.

Information about the disclosed incidents is also quite limited since in most cases the affected organisations are unaware of how threat actors managed to get initial access. In the end, organisations might deal with the issue internally (e.g. decide to pay the ransom) to avoid negative publicity and ensure business continuity. However, such an approach does not help fight the cause, on the contrary, it encourages the phenomenon instead, fuelling the ransomware business model in the process.

It is in the context of such challenges that ENISA is exploring ways to improve this reporting of incidents. The revised Network and Information Security Directive (NIS 2) is expected to change the way cybersecurity incidents are notified. The new provisions will aim to support a better mapping and understanding of the relevant incidents.

What Ransomware Does: The Lifecycle & Business Models

According to the analysis of the report, ransomware attacks can target assets in four different ways: the attack can either Lock, Encrypt, Delete or Steal (LEDS) the target's assets. Targeted assets can be anything such as documents or tools from files, databases, web services, content management systems, screens, master boot records (MBR), master file tables (MFT), and many others.

The life cycle of ransomware remained unchanged until around 2018, when ransomware started to add more functionality and blackmailing techniques matured.

ENISA identify five stages of a ransomware attack: initial access, execution, action on objectives, blackmail, and ransom negotiation, although these stages do not follow a strict sequential path. The five different ransomware business models are:-  

  • A model focused around individual attackers;
  • A model focused around group threat actors;
  • A ransomware-as-a-service model;
  • A data brokerage model; and,
  • A model aimed mostly at achieving notoriety as key for a successful ransomware business (ransomware operators need to maintain a certain reputation of notoriety, otherwise, victims will not pay the ransom).  

Report Recommendations

Strengthen your resilience against ransomware by taking actions including:

  •  Keep an updated backup of your business files & personal data;
  •  Keep this backup isolated from the network;
  •  Apply the 3-2-1 rule of backup: 3 copies, 2 different storage media, 1 copy offsite;
  •  Run security software designed to detect most ransomware in your endpoint devices;
  •  Restrict administrative privileges; etc.

If you fall victim to a ransomware attack

  •  Contact the national cybersecurity authorities or law enforcement for guidance;
  •  Do not pay the ransom and do not negotiate with the threat actors;
  • Quarantine the affected system;
  • Visit the No More Ransom Project, a Europol initiative.

ENISA strongly recommended to share your ransomware incident information with your relevant authorities to be enable them to alert potential victims, identify threat actors, support the security research and develop means to prevent such attacks or better respond to them.

ENISA Threat Landscape for Ransomware Attacks

You Might Also Read:

The European Union Adopts A Cyber Security Strategy:

 

« Flunking Cyber Education
How to Prepare Your Security Team For The Future Of Vulnerability Management »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Conscio Technologies

Conscio Technologies

Conscio Technologies is a specialist in IT security awareness. Our solutions allow you to easily manage innovative online IT awareness campaigns.

Atempo

Atempo

Atempo is a leading independent European-based software vendor with a global presence. We provide solutions to protect, store, move and recover all your data.

Resilience First

Resilience First

Resilience First is a not-for-profit organisation, led and funded by business to strengthen collective business resilience in all areas, including cyber security.

Me Learning

Me Learning

Me Learning provides engaging, informative and clearly explained learning materials for complex and challenging professional environments in areas including GDPR and Information Governance.

Vintegris

Vintegris

Vintegris are a Certification Authority and manufacturer of innovative systems and applications for the full cycle of digital identity.

Penacity

Penacity

Penacity, LLC provides strategic consulting technology services and Information Security Services to commercial and government organizations.

Invensity

Invensity

INVENSITY is an interdisciplinary technology and innovation consulting company. Centres of excellence include Cyber Security and Data Privacy.

eSec Forte Technologies

eSec Forte Technologies

eSec Forte Technologies is a CMMI Level-3 ISO 9001-2008, 27001-2013 certified global consulting and implementation company focused on Information Security and Cyber Security.

Thoma Bravo

Thoma Bravo

Thoma Bravo is a leading private equity firm with a 40+ year history and a focus on investing in software and technology companies.

Iterasec

Iterasec

Iterasec provides a full range of security services to hacker-proof your products and make software engineering process secure by design.

Secureframe

Secureframe

Companies from startups to enterprises use Secureframe to automate SOC 2 and ISO 27001 compliance, complete audits, and continuously monitor their security.

Open Web Application Security Project (OWASP)

Open Web Application Security Project (OWASP)

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software.

Willyama Services

Willyama Services

Willyama Services is a certified Information Technology and Cybersecurity professional services business providing services to government and private sector clients.

Covenant Technologies

Covenant Technologies

Make Covenant Technologies the only choice for your IT and cybersecurity recruitment needs. We deliver quality candidates at the forefront of the cybersecurity and IT industry.

Gutsy

Gutsy

Gutsy uses process mining to help organizations visualize and analyze their complex security processes to understand how they actually run, based on observable event data.

IndoSec

IndoSec

IndoSec is an annual cybersecurity summit that powers an in-person gathering of cybersecurity leaders from Indonesia’s major corporations, leading businesses and key government entities.