Ransomware extortion does not cease after paying the ransom

A world survey that seemed into the expertise of ransomware victims highlights the dearth of trustworthiness of ransomware actors, as typically of paying the ransom, the extortion merely continues.

This isn’t a stunning or new discovery, however when seeing it mirrored in precise statistics, one can recognize the size of the issue in full.

The survey was carried out by cybersecurity specialist Venafi, and an important findings that emerge from the respondents are the next:

• 83% of all ransomware victims who paid the requested quantity had been extorted once more, twice, and even thrice.
• 18% of victims who paid the ransom nonetheless had their information uncovered on the darkish internet.
• 8% refused to pay the ransom, and the attackers tried to extort their prospects.
• 35% of victims paid the ransom however had been nonetheless unable to retrieve their information.

As for the ransomware actor extortion ways, these are summarized as follows:

• 38% of ransomware assaults threatened to make use of stolen information to extort prospects.
• 35% of ransomware assaults threatened to show stolen information on the darkish internet.
• 32% of assaults threatened to straight inform the sufferer’s prospects of the info breach incident.

The dearth of credibility in ransomware actors’ empty guarantees to their victims stems from a number of components.

First, most RaaS operations are short-lived, in order that they merely look to maximise their earnings within the shortest potential time period. As such, they do not care about long-term repute.

Secondly, many renegade associates do not observe the foundations set by the core ransomware operators, and implementing these guidelines is never thought of a precedence for these teams.

Thirdly, even when the info is not leaked immediately, the remnants of information breaches could also be maintained for a very long time in a number of risk actor programs and nearly all the time discover their approach to the broader cyber-crime neighborhood ultimately.

A vicious cycle

As Venafi underlines in its report, paying the ransom is just motivating crooks to return for extra, because it sends the sign that the sufferer sees this as the simplest means out of bother, which is nothing however an phantasm.

“Organizations are unprepared to defend in opposition to ransomware that exfiltrates information, in order that they pay the ransom, however this solely motivates attackers to hunt extra,” – feedback Venafi’s vp, Kevin Bocek

“The dangerous information is that attackers are following by means of on extortion threats, even after the ransom has been paid! This implies CISOs are beneath way more stress as a result of a profitable assault is more likely to create a full scale service disruption that impacts prospects.”

The above matches the findings of one other report revealed by Proofpoint yesterday, which presents the outcomes of a survey of hundreds of workers and tons of of IT professionals throughout seven nations.

70% of the survey contributors report having skilled not less than one ransomware assault in 2021. 60% of them opted to barter with the attackers, and lots of of them ended up paying ransom greater than as soon as.

In abstract, one of the best strategy for victims is to not give in to ransomware calls for however as an alternative restore programs and information from backups and alert the regulation enforcement and information safety authorities of the incident.

All else is futile contemplating that every one situations ultimately result in the identical consequence, with the one distinction being the enrichment of ransomware actors and the feeding of their motivation to proceed.