As one of the world’s most infamous ransomware gangs, Lockbit, warns Kash Patel it has data that could destroy the FBI, enterprises need to be more concerned with a shift in cybercrime tactics that could destroy their business. Here’s what you need to know.
Nearly All Ransomware Attacks Now Steal Data Rather Than Just Encrypt It
With Russia-affiliated groups such as Lockbit rising from the dead, and new threat actors such as BlackLock, the world’s fastest-rising ransomware operation strike, enterprises should be in no doubt that this particularly despicable genre of cybercrime, willing to attack critical health providers, has evolved. A Feb. 26 report from Arctic Wolf has revealed that 96% of all reported ransomware incidents across 2024 included data exfiltration as attackers double down on leveraging the extortion threat.
The newly published research shows that the double extortion tactic of stealing data as well as encrypting it, introduced by ransomware actors in response to stronger backup and respiration capabilities of potential victims, along with a better understanding of the threat itself, is no longer the exception but the norm. This “highlights a critical shift in cybercriminal behavior,” Kerri Shafer-Page, vice president of incident response at Arctic Wolf, said; “Threat actors are no longer just locking up data with ransomware; they’re stealing it first to maximize pressure on victims.” Doing so, of course, helps to protect the revenue streams of these organized criminal operations.
Ransomware Has A Very Long Tail Of Threat Actors
Referring to the ransomware landscape as a modern-day hydra, the Arctic Wolf report said that the by-now very well-established ransomware-as-a-service model has “democratized access to ransomware software, intrusion tools, and — via initial access brokers — IT environments.” The end result is a very long tail of threat actors, all of whom are looking for a profitable piece of the cybercrime pie. Arctic Wolf analysts observed more than 50 unique ransomware threat actors in victim environments., the report stated. “Like the Hydra of Greek mythology,” the report said, “when a ransomware operation ceases to exist — whether due to law-enforcement operations, infighting, politics or retirement — other groups (new and old) fill the void.”
Just how profitable is the pie in question? According to Arctic Wolf, median ransom demands across 2024 came in at $600,000, “demonstrating that ransomware remains a lucrative business for cybercriminals despite increased law enforcement action.”
