Secureworks: Ransomware takedowns didn’t put off cyber criminals
The number of active cyber criminal ransomware gangs has surged by almost a third in the space of 12 months, according to the latest intelligence from Secureworks
The brutal dismantling of the LockBit ransomware crew and the humiliation of its key players has been one of the most talked about cyber security success stories of the past 12 months, but looking at the raw data, it doesn’t seem to have done much to dissuade cyber criminals.
This is according to Secureworks’ 2024 State of the threat report, which today draws back the curtain to reveal a 30% year-on-year rise in active ransomware groups using name-and-shame leak sites, with 31 new actors entering the ecosystem from June 2023 to July 2024.
Given the LockBit takedown took place in February, it may not be much of a surprise to learn that the gang accounted for 17% of ransomware listings for the period in scope, although this was down 8% year on year given the disruption caused by the UK’s National Crime Agency (NCA), which led the Operation Cronos assault.
Meanwhile, the second most active ransomware gang, Play, doubled its victim count year on year, while RansomHub, a group that emerged shortly after LockBit’s takedown, has in the space of just a few months become the third most active group on the scene, with a 7% share of listed victims. Qilin, as well, has been making its mark, notably in its high-profile attack on NHS partner Synnovis.
“Ransomware is a business that is nothing without its affiliate model. In the last year, law enforcement activity has shattered old allegiances, reshaping the business of cyber crime. Originally chaotic in their response, threat actors have refined their business operations and how they work. The result is a larger number of groups, underpinned by substantial affiliate migration,” said Don Smith, vice-president of threat intelligence at Secureworks Counter Threat Unit (CTU).
“As the ecosystem evolves, we have entropy in threat groups, but also unpredictability in playbooks, adding significant complexity for network defenders,” said Smith.
More gangs, fewer victims
But despite this growth, victim numbers have not yet been seen rising at a similar pace, possibly the result of gangs trying to find their place in a more fragmented landscape.
The CTU team also observed a lot of affiliate movement in the ransomware ecosystem, which may be partly driving this trend. In many cases during the past 12 months, the researchers observed a number of ransomware attacks where victims were listed on more than one site, possibly as a result of affiliates looking for new outlets for their work in the increasingly chaotic ecosystem.
Threat actors have refined their business operations and how they work. The result is a larger number of groups, underpinned by substantial affiliate migration
Don Smith, Secureworks Counter Threat Unit
And chaotic the past 12 months have most certainly been. Secureworks analysts said the trend has clearly been a broadening of the ransomware landscape so that a landscape previously dominated by a smaller number of large operations is now home to a more diverse group of cyber brigands.
However, this may be leading to a more dangerous Wild West-style threat landscape where smaller groups have less responsibility and structure in terms of how they operate. For example, a drop in median dwell times observed this year seems to be the result of criminals moving fast and breaking things in lightning-paced smash-and-grab attacks.
As the new ecosystem evolves and coalesces over the coming months, Secureworks said defenders should expect to see a lot more variation and shifts in attack methodologies.
Some of the new methodologies already observed in the field include an increasing tendency for ransomware gangs to steal credentials and session cookies to gain access through adversary-in-the-middle (AitM), sometimes known as man-in-the-middle (MitM), attacks using phishing kits such es EvilProxy or Tycoon2FA, which are readily available on the dark web. The research team said this trend should be ringing alarm bells for defenders as it potentially reduces the effectiveness of some types of multifactor authentication (MFA).
Nor are ransomware gangs immune to the appeal of artificial intelligence (AI). Ever since the launch of ChatGPT nearly two years ago, there has been chatter in the criminal fraternity about how such models can be deployed for nefarious purposes – mostly for phishing – but some of the use cases are rather more novel.
In one attack investigated by Secureworks, a cyber criminal gang monitored Google trends following a celebrity death to identify interest in obituaries, and then used generative AI to create tributes on malicious sites that were manipulated to the top of Google searches by SEO poisoning. Such sites could easily be used as a vector for the spread of malware or ransomware.
“The cyber crime landscape continues to evolve – sometimes minor, occasionally more significant. The growing use of AI lends scale to threat actors, however the increase of AitM attacks presents a more immediate problem for enterprises, reinforcing that identity is the perimeter and should cause enterprises to take stock and reflect on their defensive posture,” said Smith.
Read more about ransomware
Proposals from legislators in Washington DC could shake up the global ransomware ecosystem and give law enforcement sweeping new powers.
IBM publishes data on the spiralling costs of cyber attacks and data breaches, while researchers identify what appears to be the largest ransomware payment ever made.
The London Borough of Hackney has been reprimanded by the ICO over a series of failures that led to a devastating ransomware attack.
