Ransomware attacks continue to pose a significant threat to organizations and industries worldwide. The Q4 2022 ransomware report by ReliaQuest (formerly Digital Shadows) comprehensively analyzes the latest trends and developments in the ransomware landscape. The report is based on primary and secondary source reporting and offers valuable insights for organizations and industries that are at risk of ransomware attacks.
ReliaQuest, a leading provider of cyber threat intelligence and security solutions, has extensive experience monitoring ransomware groups and tracking their activity. Through its research and analysis, ReliaQuest is able to provide an in-depth understanding of the current state of ransomware and the challenges it poses for organizations.
Key Findings
The report revealed a number of key findings regarding the state of ransomware in Q4 2022. One of the most notable findings is the increase in the number of victims named on data leak sites in Q4. The number of victims named in Q4 2022 was 707, representing a 6.5% increase from Q3 2022. This brings the overall number of victims named in 2022 to 2549, a 7.2% increase from the 2377 victims named in 2021. This trend highlights the continued growth of ransomware attacks and the need for organizations to take proactive measures to protect themselves.
LockBit, a known ransomware group, was identified as the most active group in Q4, with 160 victims. Other active groups included Alphv, Royal, and Basta. The arrest of a suspected member of LockBit, Mikhail Vasiliev, only resulted in a temporary blip in the group’s overall activity. This highlights the challenges law enforcement agencies face in their efforts to combat ransomware attacks.
One of the biggest surprises of Q4 2022 was the debut of the “Royal” ransomware group. Discovered on November 3rd, the group quickly chalked up 73 victims on its data-leak sites. The group is suspected of having links to the infamous Conti group. The emergence of new groups, such as Royal, highlights the need for organizations to stay informed and up-to-date on the latest ransomware trends and developments.
Ransomware Trends And Developments
The report also identified a number of trends and developments in the ransomware landscape in Q4 2022. One significant development was the use of ransomware in hacktivism’s resurgence during the year. The popularity of hacktivism was primarily inspired by the Russia-Ukraine war, and the lines between threat-actor categories have become increasingly blurred. Russian hacktivists, for example, have been using ransomware against Ukrainian organizations. This highlights the challenges faced by organizations in identifying and responding to ransomware attacks, particularly when the lines between different types of threat actors are blurred.
The report also discussed the evolution of ransomware tactics and techniques. New groups have emerged, and existing groups have adopted new methods of operation, such as double extortion and targeting specific industries or regions. These new tactics and techniques pose significant challenges for organizations and law enforcement agencies. For example, the use of double extortion, where attackers threaten to encrypt data and release sensitive information, puts organizations in a difficult position and increases the likelihood of them paying the ransom.
Vulnerable Sectors And Regions
The report also identified sectors and regions that are particularly vulnerable to ransomware attacks. These include industries that are dependent on technology, such as healthcare and finance and regions with a lack of cybersecurity measures. The report also identified common characteristics among victims, such as the use of outdated software or a lack of employee training on cybersecurity best practices.
These findings highlight the need for organizations to implement strong cybersecurity measures and practices to protect themselves from ransomware attacks. This includes regularly updating software and systems, providing employee training on cybersecurity best practices, and implementing robust incident response plans. Additionally, organizations should also consider investing in cybersecurity insurance to mitigate the financial impact of a ransomware attack.
Expectations For Q1 2023
The report concludes with predictions and expectations for ransomware activity in the first quarter of 2023. Based on the trends and developments observed in Q4 2022, the report suggests that ransomware attacks will continue to be a significant threat to organizations in the first quarter of 2023. The report also highlights the potential for new groups to emerge and for existing groups to adopt new tactics and techniques.
One trend that may continue to gain momentum in Q1 2023 is the use of double extortion tactics, where attackers threaten to both encrypt data and release sensitive information. This puts organizations in a difficult position, as paying the ransom may not guarantee the safe return of their data. Furthermore, these groups may also focus on targeting specific industries or regions, such as healthcare or finance, where the impact of a successful attack could be more severe.
Another trend that may increase in Q1 2023 is the use of ransomware-as-a-service (RaaS) business models. These models allow less technically-savvy cybercriminals to carry out ransomware attacks by renting out ransomware and other tools from more experienced cybercriminals. This could increase the number of attacks and the broader range of attackers in the market.
Moreover, the report suggests that ransomware attacks may also be increasingly used in conjunction with other types of cyber attacks, such as supply chain attacks. This could make it more difficult for organizations to detect and prevent these attacks, as they may not be aware that they have been targeted until it is too late.
It is important to note that the report’s predictions are based on the current state of the ransomware landscape and on previous trends; it is possible that there could be unexpected developments that could change the state of the threat. Organizations should therefore be prepared for the possibility of new and evolving threats.
In light of these predictions, the report recommends that organizations take a proactive approach to cybersecurity. This includes regularly reviewing and updating their incident response plans, providing employee training on cybersecurity best practices, and investing in cybersecurity insurance. Additionally, organizations should also consider implementing advanced security solutions such as endpoint protection, network security, and incident response. Organizations should also keep an eye on emerging trends and update their security measures accordingly.
Prevention and Mitigation Strategies
In addition to the recommendations provided in the previous section, organizations can implement various prevention and mitigation strategies to reduce their risk of falling victim to a ransomware attack. These include:
- Regularly backing up important data and storing it offline or in a secure cloud-based storage system. This ensures that organizations have access to a clean copy of their data in the event of a ransomware attack.
- Regularly patching and updating software and systems to address known vulnerabilities.
- Implementing a robust access control system to limit the number of individuals who have access to sensitive data and systems.
- Conducting regular security audits and penetration testing to identify and address vulnerabilities within the organization’s network.
- Educating employees on safe browsing practices, such as avoiding clicking on suspicious links or opening attachments from unknown sources.
Additionally, organizations should also be aware of the potential for ransomware attacks to spread within the network. Therefore, it is essential to implement proper segmentation and network isolation techniques to prevent the ransomware from spreading to other systems.
The Impact Of Ransomware On Businesses
Ransomware attacks can significantly impact businesses, both financially and reputationally. Financially, the cost of paying the ransom, restoring data, and repairing systems can be substantial. In some cases, organizations may even need to shut down operations temporarily while they work to recover from an attack.
Moreover, the damage to reputation and loss of customer trust can be even more significant. Businesses that fall victim to a ransomware attack may face negative publicity and a loss of customers. This is particularly true for businesses in the healthcare, finance, and retail sectors, where customer data is considered sensitive and private.
In addition to the direct costs and reputational damage, businesses may also face legal and regulatory consequences. For example, if customer data is compromised in a ransomware attack, the business may be liable for failing to protect that data. This could result in fines, legal action, and damage to the business’s reputation.
Furthermore, businesses may also experience operational disruption as a result of a ransomware attack. For example, if a business’s systems are encrypted, employees may be unable to access important information and systems, which can lead to delays and inefficiencies. Additionally, businesses may be forced to halt certain operations or delay projects until the issue is resolved, which can result in lost productivity and revenue.
In addition to the direct costs, businesses may face indirect costs such as loss of business opportunities, damage to relationships with partners and suppliers, and even the loss of critical employees.
It is important to note that not only the financial impact of a ransomware attack is essential but also the intangible impacts, such as loss of intellectual property, trade secrets, or confidential information. These can have a long-term impact on the business and may be difficult or impossible to quantify in terms of financial loss.
Given the potential impact of a ransomware attack, it is essential for businesses to take proactive measures to protect themselves. This includes implementing robust security measures, providing employee training on cybersecurity best practices, and developing incident response plans. Businesses should also consider investing in cybersecurity insurance to mitigate the financial impact of a ransomware attack. By taking these steps, businesses can reduce their risk of falling victim to a ransomware attack and minimize the impact of an attack should it occur.
Conclusion
Ransomware attacks continue to be a significant threat to organizations worldwide. The Q4 2022 ransomware report by ReliaQuest provides a comprehensive analysis of the latest trends and developments in the ransomware landscape. The report highlights the continued growth of ransomware attacks, the emergence of new groups, and the evolution of tactics and techniques. Organizations can reduce their risk of falling victim to a ransomware attack by taking a proactive approach to cybersecurity and implementing various prevention and mitigation strategies. By staying informed and up-to-date on the latest ransomware trends, organizations can better prepare for and defend against these attacks.
“Extortion has been used as leverage to coerce payment for the ransom. But, for some attacks, where the ransom is not paid as a matter of principal, or the victim was able to recover from backups. Extortion is the way to profit. If data can be exfiltrated and money paid to prevent the leak of that data without all the headaches of encryption, then it is more lucrative and efficient for criminals.”
Overall, this is good news for the industry. The U.S. has always had a policy of “we don’t negotiate with terrorists”. The reasoning behind this is sound. If you pay they have incentive to keep their criminal enterprise going. However in the world of Ransomware we’ve seen guidance from the FBI that previously suggested you should pay the ransom to its current evolution of “don’t” pay the ransom, the latter being the only thing that makes sense as a policy. Even when users pay the Ransom the data suggests that less than 65% of their data is ever fully recovered and the down time can be weeks or even months.
The effects of being hit with ransomware are amplified in the short term by this “don’t pay” strategy but are better in the long run for the market as a whole, however there is an even better solution. Don’t allow criminals to encrypt your data in the first place. Following best practices like strong patch hygiene, zero trust, MFA and best of breed endpoint security is only part of the solution. You have to assume the criminals can bypass these like they’ve done in countless other events. You need proper ransomware containment tools in place that can shut down an encryption event in milliseconds and data backups so the criminals have nothing to demand a ransom against. The tools exist and the cost is surprisingly low. With containment solutions encryption events are limited to a handful of files rather than millions.
Ransomware victims are turning the tables on hackers. Companies’ tactics are increasingly effective at countering the rising threat posed by malicious actors by baking ransomware resiliency into their organisations.
Protection from attacks is just one side of the story. Despite advancements in defences, it is not currently possible to ward off every single attack, every single time. Therefore, ransomware resiliency, the ability to recover fast is critical. Data backups are key, as they act as an insurance policy against attack. It’s essential to have up to date back-up management protection programmes and policies so that if data is lost to a successful ransomware attack, its backup can simply be restored to the most recent back-up point, minimising data loss and negating the need to pay the ransom. This leaves companies in a much stronger position when it comes to refusing to pay a ransom.
Even with protection and back-up in place, companies cannot rest on their laurels. Hackers’ tactics are constantly evolving, with threats such as double and even triple extortion set to swing the balance back in favour of hackers if businesses don’t act to protect and regular back-up their data.