Ransomware Payments Skyrocket Amid 2021’s ‘Quadruple Extortion’ Trend

by | August 14, 2021 | Cybersecurity News

With the average ransomware payments leaping over half a million dollars and a 64% year-over-year increase in ransomware attacks, things are not looking that good for companies who still sleep on a proper security awareness training program.

Two recent reports drop heavy figures on the already obvious ugly truth. First, ransomware attacks happen more often than ever, and second, payouts are not predicted to decrease anytime soon.

The average ransomware payment saw a massive 82% increase from last year. According to Unit 42’s report, it’s now over half a million dollars. As far as the wake of ransomware attacks goes, Barracuda researchers reported on Tuesday that they’ve spotted and examined 121 such attacks so far this year, a 64% increase compared to 2020.

The key factor in the massive increase in extortion payments is the fact that hackers have been investing in extremely profitable ransomware operations, including a concerning emerging trend, the “quadruple extortion.”

The “Quadruple Extortion” Strategy Gets Cybercriminals Massive Ransomware Payments

Double extortion has been around for some time now. Threat actors freeze a victim’s systems and/or data but also threaten to publish the compromised data if the victim refuses to pay up.

But apparently, cybercriminals got even more aggressive and creative, using as many as four techniques to make sure they get as much money as possible from victims, according to Unit 42 researchers.

The new quadruple extortion method follows the steps below:

  1. Encryption: Victims pay to regain access to scrambled data and compromised computer systems that stop working because key files are encrypted.
  2. Data Theft: Hackers release sensitive information if a ransom is not paid.
  3. DoS: Ransomware gangs launch DoS attacks that shut down a victim’s public websites.
  4. Harassment: Cybercriminals contact customers, business partners, employees and media to tell them the organization was hacked.

These added tactics have fattened already increasing ransoms. Unit 42 reported that the average ransom payment shot up to $570,000 during the first half of this year.

“While it’s rare for one organization to be the victim of all four techniques, this year we have increasingly seen ransomware gangs engage in additional approaches when victims don’t pay up after encryption and data theft,” Unit 42 reported.

“Among the dozens of cases that Unit 42 consultants reviewed in the first half of 2021, the average ransom demand was $5.3 million. That’s up 518 percent from the 2020 average of $847,000,” researchers observed.

More concerning figures from Unit 42’s report show that the highest ransom demand from a single victim rose to $50 million in this year’s first half, almost doubling last year’s $30 million demand. So far, the largest payment confirmed by Unit 42 was the $11 million paid by JBS SA after a massive attack in June. Last year’s largest payout was $10 million.

Barracuda has also observed a significant increase in ransom demands: In the attacks that it has examined, the average ransom payment solicited per incident was over $10 million, with only 18% of attacks asking for less than that. A whopping 30% of ransomware payments demanded by hackers were over $30 million.

Barracuda indicated the cause of spiked extortion demands as the wider adoption and use of cryptocurrency. The firm reported that this growing prevalence of cryptocurrency has resulted in “a correlation of increased ransomware attacks and higher ransom amounts. With increased crackdown on bitcoin and successful tracing of transactions, criminals are starting to provide alternative payments methods, such as the REvil ransomware gang asking for Monero instead of Bitcoin.”

Who Is A Good Target For Ransomware Attacks

In a recent post, Shi noted that ransomware attacks can hit companies of all sizes.

The grim outlook for the future of ransomware leaves no one spared from financial damage or brand-crushing headlines,” Shi wrote. “Ransomware criminals are penetrating the foundation of our digital economy, from trusted software vendors to IT service providers.”

While hackers are still focusing on municipalities, healthcare, and education, attacks on other kinds of businesses are surging.

“Attacks on corporations, such as infrastructure, travel, financial services, and other businesses, made up 57 percent of all ransomware attacks between August 2020 and July 2021, up from just 18 percent in our 2020 study. Infrastructure-related businesses account for 10 percent of all the attacks we studied.”

Here, at ATTACK Simulator, we take cybersecurity seriously. For example, we know that most ransomware attacks are carried out through phishing, which is why we focus on training, educating, and equipping your staff with the best up-to-date security practices they need to spot and deflect phishing attempts.

Our security awareness training program can spare you potentially immense ransomware payments.

Train your employees to stay away from cyberthreats with ATTACK Simulator’s comprehensive 4-Step Phishing Simulations.

Invest a small amount today to protect your business’s tomorrow and possibly spare a fortune. Get your quote here.

Sources:

ThreatPost threatpost.com/ransomware-payments-quadruple-extortion/

The Cybersecurity News thecybersecurity.news/vulnerabilities/ransomware-payments-explode

Attribution:

Photo by Sharon McCutcheon on Unsplash

by Diana Panduru

Content writer for Attack Simulator. Passionate about all things writing and cybersecurity, and obsessed with driving. I sometimes indulge in pencil drawing, poetry, and cooking for fun.

There’s no reason to postpone training your employees

Get a quote based on your organization’s needs and start building a strong cyber security infrastructure today.