Ransomware Often Begins With Phishing

Ransomware attacks are becoming increasingly devastating to companies. Not only do they inflict massive disruptions to operations, but criminals are also asking for ever-larger ransoms to unlock the encrypted files and machines hit by the attacks. 
 
Some security experts are urging the government to go further and, despite the difficulties in enforcing such a law, make it illegal to pay ransoms to ransomware groups. Recent events have hardened this opinion and increased support for such an option. Indeed,  and some security firms have pointed out that companies that pay ransoms are simply funding the next round of attacks.
 
Only a few weeks ago, an attack paralysed Ireland’s health services for weeks in the middle of a pandemic. The attack happened in the wake of the Colonial Pipeline attack that caused fear of gas shortages. CNA Financial, one of the largest insurance companies in the US, apparently paid $40m to get access to its files and to restore its operations, making it the largest reported ransom paid to date. 
 
Due to the surges in state-sponsored ransomware attacks in the US and Europe, many government institutions, including the White House, have urged companies to bolster their defences to help stop the ransomware groups. The G7 group has called on Russia, in particular, to identify, disrupt, and hold to account those within its borders who conduct ransomware attacks and other cyber crimes. ​One of the few outcomes of the Biden-Putin summit is an agreement to consult on cybersecurity. However, the agreement is ambiguous without any specific actions.
 
Phishing and ransomware have become the most rampant form of cyber crime and an exponentially increasing threat to organisations. 
 
  • Phishing is a method of trying to gather personal information using deceptive e-mails and websites. 
  • Ransomware is a form of malware designed for the sole purpose of extorting money from victims.

Right now, phishing is e delivery mechanism of choice for ransomware and other malware, are critical problems that every organisation must address through a variety of means.   

Phishing Is One Of The Main Ways To Deliver A Cyber Attack 

Phishing emails come in all varieties, asking recipients to click on a malicious link, featuring attached files masking malware, or simply looking for a reply to begin information gathering, according to a new survey from the data storage specialist firm Cloudian that talked to 200 IT decision-makers whose organisations has had ransomware attack over the last two years. 
 
  • The survey reports that 50% say they have held anti-phishing training among employees, and 49% had perimeter defences in place when they were attacked.  
  • Nearly 25% of all survey respondents said their ransomware attacks started through phishing, and of those victims, 65% had conducted anti-phishing training sessions. 
  • For enterprises with fewer than 500 employees, 41% said their attacks started with phishing. About one-third of all victims said their public cloud was the entry point ransomware groups used to attack them.  
What really distinguishes phishing is the form the message takes: the attackers masquerade as a trusted entity of some kind, often a real or plausibly real person, or a company the victim might do business with.  It's one of the oldest types of cyber-attacks and is still one of the most widespread, with phishing messages and techniques becoming increasingly sophisticated.
 
"This reflects the increasing sophistication of phishing schemes, with attackers now mimicking emails from trusted associates such as high-level executives (known as 'whaling' attacks). These emails will sometimes include personal details, usually gleaned from social media, making it more likely that even a wary individual will fall prey," the report explained. Criminals rely on deception and creating a sense of urgency to achieve success with their phishing campaigns.
 
Crises such as the coronavirus pandemic give criminals a big opportunity to lure victims into taking their phishing bait. 
 
The speed of ransomware groups is also startling, with 56% saying ransomware actors managed to take over their data and send a ransom demand in under 12 hours. 30% said their data was taken in 24 hours. For companies attacked through phishing, 76% of victims noted that attackers took over systems within 12 hours. The Cloudian report found that "44% of respondents' total data was held hostage, with financial, operational, customer and employee data all being targeted." Enterprises experienced an average downtime of three days.  
 
  • The average financial cost for respondents was nearly $500,000, and 55% said they ended up paying the ransom, with an average ransom cost of $223,000.
  • Nearly 15% said they paid $500,000 or more. Even after paying, just 57% were able to get all of their data back. 
These findings reveal an unwelcome truth about such attacks, which is that they are hard to prevent even when you're prepared.
 
Ransomware can penetrate quickly, significantly impacting an organisation's financials, operations, customers, employees and reputation. Even if you pay the ransom, other related costs can be significant.   
 
  • The other costs associated with responding to a ransomware attack added up to an average of $183,000.
  • More than half of respondents dealt with additional impacts to "their financials, operations, employees, customers and reputation." 
"The threat of ransomware will continue to plague organisations around the world if they do not change their approach and response to it," said Jon Toor, chief marketing officer at Cloudian. Organisations should consider using a fully integrated solution that simplifies configuration, goes beyond signature-based detection, and protects from insider spear phishing attacks.

Possible Ways Forward:

  • Law enforcement agencies must cooperate across borders to target ransomware groups, track payments and ultimately change the operational risk for these groups so that it is more expensive to do illicit business.
  • Breaking down silos within organisations, getting the cyber security, IT operations and risk management teams to speak the same language and align expectations. 
  • GDPR has done a lot to bring focus and awareness about reporting breaches to infrastructure. But more is needed.

GPDR works for personal data, but disruptions to critical infrastructure following a ransomware attack are not necessarily under the umbrella of GDPR and can go under the radar. Only with more sharing, increased focus and potentially fines levied against organisations that fail to prevent or protect their infrastructure adequately, will  business leaders begin to take the threat seriously.  

Deloitte:      Dark Reading      Logpoint:     Techtarget:    CSO Online:    VadeSecure:
 
ZDNet:     EMISOFT:     I-HLS:  
 
You Might Also Read:
 
Cyber Crime In 2021: How Hackers Are Evolving:
 
 
« Was There A Russian Plot To Put Trump In The White House?
Twitter Celebrity Hack Suspect Arrested »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Advent IM

Advent IM

Advent IM is one of the UK’s leading independent cyber security specialists, with a unique approach to providing holistic security management solutions.

Puppet

Puppet

Puppet is a leader in IT automation. Our software helps DevOps securely automate configuration and management of machines and the software running on them.

EIT Digital

EIT Digital

EIT Digital is a leading digital innovation and entrepreneurial education organisation driving Europe’s digital transformation. Areas of focus include digital infrastructure and cyber security.

Tigerscheme

Tigerscheme

Tigerscheme is a certification scheme for information security specialists, backed by University standards and covering a wide range of expertise.

CSI

CSI

CSI is a Managed Service Provider (MSP) delivering Hybrid Multi-Cloud, Data Protection, and Cyber Security solutions to highly regulated industries.

Netsecurity AS

Netsecurity AS

Netsecurity is a Norwegian owned company focused and specialised within IT security and cybersecurity-as-a service.

Inspira Enterprise

Inspira Enterprise

Inspira Enterprise is a leading digital transformation company with expertise in Cyber Security, Internet of Things (IOT), Blockchain, Big Data & Analytics, Intelligent Automation and Cloud Computing.

comforte AG

comforte AG

comforte AG is a leading provider of data-centric security technology. Organizations worldwide rely on our tokenization and format-preserving encryption capabilities to secure personal, sensitive data

Bright Security

Bright Security

Bright Security is a developer-centric Dynamic Application Security Testing (DAST) solution that helps organizations ship secure applications and APIs quickly and cost-effectively.

Deutsche Gesellschaft für Cybersicherheit (DGC)

Deutsche Gesellschaft für Cybersicherheit (DGC)

As a leading provider of cyber security, DGC supports companies in taking advantage of the opportunities offered by the digital transformation – and in minimizing the associated risks.

IDECSI

IDECSI

IDECSI delivers cutting-edge technology and engages all employees in the security system for effective and cost-efficient data protection.

Nclose

Nclose

Nclose is a proudly South African cyber security specialist that has been securing leading enterprises and building our security portfolio since 2006.

Gogolook

Gogolook

Gogolook is a leading TrustTech company. With "Build for Trust" as its core value, it aims to create an AI- and data-driven global anti-fraud network as well as Risk Management as a Service.

Diversified Technical Services Inc. (DTSI)

Diversified Technical Services Inc. (DTSI)

DTSI provides a wide range of technology solutions for Federal Agencies, the Department of Defense, and commerical organizations with capabilities including Cyber Security and DevSecOps.

Revytech

Revytech

Revytech is a tech company providing services in a broad range of areas including IT operations, cyber security and network engineering.

OOKOS

OOKOS

OOKOS was founded in 2023 by a team of cybersecurity veterans who recognized that traditional security models were failing to keep pace with evolving threats.