How Ransomware Attacks Are Becoming a Business
When you think about ransomware, you probably imagine a hacker who encrypts your files and demands payment in bitcoin to unlock them. But it’s way more complex than that, with sophisticated cyber criminal syndicates running operations like a business. They’re constantly updating their malware, improving the attacks they deploy and even forming networks to share resources. And the annual cost of this malware-induced extortion is forecast to reach $265 billion by 2031.
While phishing continues to be the most common attack vector, attackers often use other techniques. For example, they may exploit unpatched software or expose Remote Desktop Protocol (RDP) services to compromise systems and gain access to privileged credentials. They’re also acquiring access through Initial Access Brokers, cybercriminals who specialize in compromising organizations and sell their access to other threat actors. This specialized approach lowers the technical barrier to ransomware attacks.
Once on the network, the attack typically progresses with a shotgun approach, mapping the environment, stealing administrator credentials, harvesting cached passwords, exploiting privilege escalation flaws and more. They’ll then use these elevated privileges to move laterally across the environment, stealing data and increasing the pressure during the extortion phase.
They’ll target specific systems and applications that generate the highest operational impact, such as hospitals relying on real-time systems for patient services or manufacturing facilities losing revenue for every hour a production line is offline. They’ll also disable or target backups to make system recovery harder. The attackers are savvy too; they’re also increasingly stealing customer records, financial data, employee information, intellectual property and contracts to increase their profit margin.