Ransomware victims are refusing to pay, causing the attackers' income to decline.
January 24, 2023 By Awanish Kumar
(Image Credit Google)
According to two separate studies, ransomware is no longer the lucrative, enterprise-scale gotcha it once was. The number of victims and the profit the attackers make in 2022 has dropped dramatically. A blockchain analysis firm that has worked with law enforcement and government agencies, suggests in a blog post that, payments to Ransomware attackers fell from $766 million in 2021 to $457 million in 2018, based on payments to cryptocurrency addresses it has identified as linked to Ransomware attacks. For this report, the company notes that its wallet data does not provide a comprehensive study of ransomware and that it had to raise its 2021 total from $602 to $457. Chainalysis's data do, however, suggest payments have decreased since the pandemic peak, if not since the attacks.
Chainalysis's report also pointed out that attackers are switching malware strains more quickly and that more well-known criminals are storing their money in mainstream cryptocurrency exchanges instead of illicit and funds-mixing destinations that were more prevalent during ransomware boom times. This might suggest a mature market with a higher barrier to entry. Chainalysis suggests that there's more to this than conventional economics. Smaller attackers often switch between different Ransomware-as-a-service (RaaS) vendors to perform various A/B tests on their targets. When Conti, a major ransomware strain, was found to be working with the Kremlin and the Russian Federal Security Service (FSB) to strike a deal, victims had another reason to avoid paying—government sanctions.
Chainalysis notes that Conti's leaders split and ended up collaborating with other ransomware groups. While ransomware may appear to be a vast industry with thousands of participants, it is still a small, traceable group of core actors that can be tracked. Coveware, a cybersecurity analysis firm, has also observed these trends, reporting that the number of victims who paid for Ransomware attacks fell from 85 percent in Q1 2019 to 37 percent in Q4 2022. The firm credits this drop to investments in security and response planning, improvements in law enforcement's ability to recover money and arrest criminals, and the compounding effects of fewer payments driving Ransomware attackers from the market.
Also read: LockBit ransomware gang apologizes for hospital attack and offers free decryptor to SickKids
Bottom line:
The majority of it is consistent with Chainalysis' analysis, but Coveware has a few surprises. Average and median ransom payments climbed considerably in the fourth quarter of 2022 compared to the preceding quarter. The median size of a ransomware victim grew as well, with a particular jump in new records in the second half of 2022. According to Coveware, this growth is a direct outcome of the pressure on attackers to pay. According to Coveware's blog post, Ransomware perpetrators are driven primarily by economics, and when the economics are terrible enough, they will go to extremes of deceit and duplicity to recoup their losses.
By Awanish Kumar
I keep abreast of the latest technological developments to bring you unfiltered information about gadgets.
