Cybercrime - Ransomware: Number One Cyber Threat

These attacks have had many targets. They have been aimed at large groups in particular, but smaller structures have also been targeted. However, while only assaults on local authorities or hospitals have received media coverage, numerous other attacks have targeted all sectors. These attacks were predominantly opportunistic in nature, nevertheless some were planned specifically to guarantee the payment of a ransom. Cybercriminals choose their targets based on the assailed company’s solvency, its operational status or the fragility of its information systems.

Increasingly, profits generated by these attacks and the feeling of impunity - due to the authorities’ limited ability to punish cybercriminals - have led to the emergence of a real ransomware ecosystem within cybercrime (the next article will address the details of this ecosystem).

It should be noted that, in early 2021, law enforcement operations destabilized this ecosystem by dismantling and arresting well-established groups (e.g., Emotet and Netwalker), and by conducting targeted operations on users of these attack systems (e.g., those that hit Egregor). These operations are crucial: they have had a direct (and major) impact on the groups involved, as well as a deterrent effect on others. After Netwalker was dismantled, Ziggy and Fonix announced they were ceasing their cybercriminal activities. Despite this very promising development, dozens of platforms could replace them, and the medium-term effects remain uncertain.

Increasingly motivated cybercriminals are ever more innovative when it comes to securing ransom payments

In response to the increasing number of attacks, companies have taken protective measures that make it more difficult for cybercriminals to do business. Efficient IS backups and rebuilding strategies make blocking systems less vulnerable to ransomware. This is especially the case for large companies, though smaller ones often remain highly vulnerable.

Beyond the increasingly unrelenting ransom demands, the means used to penetrate information systems are also becoming more sophisticated. For instance, hackers tried to bribe a Tesla employee with $1million to introduce malware into the company's computer network. With funds amassed from previous attacks, cybercriminals can increase their assault capabilities and access financial resources usually only available to groups with ties to a State.

These last examples illustrate the importance of attack profitability for cybercriminals. One of the reasons why ransomware is the frontrunner in cyberattacks is that, even today, many companies pay to get a decryption key - if one exists. This encourages cybercriminals to persevere. 

Still it should be said that paying the ransom will not resolve the crisis swiftly. Indeed, even if the cybercriminals keep their promise and deliver a functional data decryption tool, it will need to be applied to the entire information system, which will then have to be secured to avoid a new intrusion (by the same culprits or others). Only after this could one progressively restart all services and ensure their proper functioning. As for stolen data, there is no way to ensure that it has actually been deleted. Measures will need to be taken to warn affected customers, entities or employees. Field observations show that the impact and duration of the crisis are almost identical for companies that have paid a ransom and for those that have not. Lastly, ransom payments can lead to legal problems, especially following the latest decisions by the United States to make some of these payments illegal.

A series of crises for companies

Given cybercriminal practices and the number of attacks, losses related to cyberattacks are piling up and represent major risks for companies - as seen in the recent attacks on Altran and Sopra Steria. The companies reported losing €20 million and €50 million respectively. In 2017, Saint-Gobain announced a €250 million loss following the attack it suffered.

These assaulted companies suffer successive shocks, like an earthquake. Three days of bewilderment during which the company is disoriented because it is unable to work or communicate without its information system. Then come three weeks of intense crisis, during which the company must rebuild its system and work with partial IT resources. Finally, it takes at least three months to consolidate and resume regular activity. Sometimes this final phase can last several years, especially when there are legal proceedings if personal data has been stolen.

In the following months, these crisis management costs turn into disorganization costs (e.g., because of the loss of efficiency due to non-functional systems, faulty internal processes, dissatisfied customers, and then the costs of rebuilding and securing the information system).

In some cases - especially in regulated sectors or if personal data has been affected - this can incur significant legal costs. Recently, British Airways was fined £20 million following an attack on its website. Initially, the fine amounted to hundreds of millions of pounds, but it was reduced and applied two years after the incident occurred, generating very negative press.

The impact of an attack on the company’s image varies on a case by case basis, even though the internal consequences are considerable. Generally speaking, the company's attitude during the crisis is decisive. 

The next article in this series focuses on the ransomware ecosystem and on how to hinder cybercrime profitability.


Copyright: DAMIEN MEYER / AFP