BotNet News

Ransomware is malware that blocks access to files or systems and demands payment to regain control. Attacks can be financially motivated and scalable, particularly through ransomware-as-a-service models that allow more attackers to participate. They can have a wide impact, disrupting operations and exposing sensitive data, even leading to business disruptions and regulatory fines in critical infrastructure sectors such as healthcare, manufacturing and utilities.

The threat landscape for ransomware is evolving rapidly. New techniques are making it easier for threat actors to get malware into your networks and, once there, to encrypt more data at higher rates with greater efficiency. And as organisations continue to migrate more data and services into the cloud, attacks may expand to less common platforms, exploiting security vulnerabilities that are often overlooked.

While most organisations can recover from a ransomware attack by reconnecting the infected systems and using secure backups, getting back to pre-attack levels of productivity will likely take a long time. And that’s before taking into account the less obvious costs – like lost customers, missed opportunities, supply chain delays and reputation damage – that may follow an incident.

Attackers are also becoming more ruthless in their attempts to coerce victims into paying up, with some families of ransomware (like REvil, Conti and Maze) publicly releasing stolen information or threatening to expose it in other ways. The extortion tactics used by hackers can be more damaging to an organisation’s relationships and reputation than any financial losses incurred during the attack. For example, Sophos Rapid Response has seen incidents where attackers have emailled or phoned employees directly, naming them by name and sharing their personal details in a bid to put pressure on them into paying the ransom.