With the recent zero-day Microsoft Office vulnerability dubbed "Follina", it's important that we all stay abreast of the latest cyber vulnerabilities, including the disturbing Ransomware trends that are plaguing our world.
2021 topped the charts in Ransomware attacks as cyber criminals found new and improved ways to attack both businesses and individuals alike. From supply chain attacks to double extortion and Ransomware as a service, the rise in ransomware brought about many new buzzwords to market.
The evolution of Ransomware has been an interesting one, full of twists and turns and we certainly don’t expect it slow down anytime soon.
Although Ransomware is not a new cyberattack method, its momentum in 2021 has brought about attention from near and far, including the highest level of government. This year alone we’ve seen several cases where Ransomware has impacted the ability to get healthcare, put gas in their vehicles and buy groceries.
And with Ransomware attacks finding their way into supply chains, the financial and operational impacts are exponential damaging.
If there is one good thing that has come from this, it’s that government and technology vendors are working together to respond and fight against this growing Ransomware trends.
WATCH ON DEMAND: HOW SMALL BUSINESSES ARE COMBATING THE RANSOMWARE EPIDEMIC
2021 Ransomware Statistics
Here we’ve gathered several ransomware statistics from the previous year to offer additional details about the growing threat landscape that is ransomware:
- The average ransomware payment in 2021 increased by 82% year over year to $570,000
- 121 ransomware incidents have been reported in the first half of 2021, up 64% year-over-year
- The largest ransom demand observed so far in 2021 is $100 million.
- Ransomware doubled in frequency in 2021, according to the 2021 "Verizon Data Breach Investigations Report."
- Approximately 37% of global organizations said they were the victim of some form of ransomware attack in 2021, according to IDC's "2021 Ransomware Study."
- The FBI's Internet Crime Complaint Center reported 2,084 ransomware complaints from January to July 31, 2021. This represents a 62% year-over-year increase.
New Ransomware Trends Emerging in 2021 and 2022
As with any emerging industry, we have seen a few new patterns that are important to note. These hackers are sophisticated and they’re realizing that some techniques provide better return on their investment. Because of this we’re seeing a lot of their efforts focused on these areas:
- Supply chain attacks. Instead of attacking a single victim, supply chain attacks extended the blast radius. A prime example of a 2021 ransomware attack is the Kaseya cyberattack, which affected at least 1,500 of its managed service provider customers.
- Double extortion. In the past, ransomware was about attackers encrypting information found on a system and then demanding a ransom in exchange for a decryption key. With double extortion, attackers also exfiltrate the data to a separate location. There, it can be used for other purposes, including leaking the information to a public website if a payment is not received.
- Ransomware as a service (RaaS). Gone are the days when every attacker had to write their own ransomware code and run a unique set of activities. RaaS is a pay-for-use malware. It enables attackers to use a platform that provides the necessary ransomware code and operational infrastructure to launch and maintain a ransomware campaign.
- Attacking unpatched systems. This was not a new trend for 2021, but it is one that continues to be an issue year after year. While there are ransomware attacks that do make use of novel zero-day vulnerabilities, most continue to abuse known vulnerabilities on unpatched systems.
- Phishing. While ransomware attacks can infect organizations in different ways, in 2021, some form of phishing email was more often than not a root cause.
Ransomware 2022 and predictions beyond
Ransomware didn't start recently, and it won't end anytime soon either. Ransomware will likely continue to evolve in a few different ways. Here are some predictions on the direction that ransomware will take in the years ahead:
- Governments will be more involved. Gartner predicted that nation-states are likely to enact legislation about ransomware payments. In 2021, Gartner estimated that only 1% of global governments have rules around ransomware, with a forecast for that to grow to 30% by 2025.
- More extortion to come. Security vendor BeyondTrust predicted that there will be a variation on double extortion with ransomware in 2022, as attackers try to execute more personalized attacks.
- Rise of intermittent encryption. In August 2021, security vendor Sophos first detected a new approach inside ransomware known as intermittent encryption. Intermittent encryption only encrypts parts of files, making them appear as corrupted data. The approach can bypass many forms of current ransomware protection and detection.
Protect your Business from Growing ransomware Threats
Protecting against the growing cyber threats is constant cat and mouse game. As IT Security experts, we're constantly working to stay one step ahead of the evolving threat landscape. If you do not have cyber insurance for your small business, it's time to get it now.
There are several things you can start to do right away to safeguard your business. ANP has a series of short videos on our YouTube page that discuss tips for tacking cyber crime that you can deploy today.
The cost of a ransomware attack is far greater than the preventative measures it takes to protect your business. Don't wait until its too late.
ANP offers managed cyber security services, to help protect your small or mid-size business. To learn about our services, visit us online for sign up for our free cyber risk assessment today.