Expert Interview Trend 3 – Ransomware Attacks on the Rise

Multi-extortion tactics, crypto-ransomware, locker ransomware and more - what types have been particularly popular this year?

In 2024, multi-extortion tactics have become increasingly common among cybercriminals. Attackers no longer limit their actions to simply encrypting data; they also threaten to release sensitive information unless a ransom is paid, a strategy known as double extortion. Crypto ransomware, which encrypts files and renders them unusable, remains the most common variant. In contrast, locker ransomware, which blocks access to the entire system, is less common as it is easier to detect and fix.

What do companies that are hit by ransomware tend to do? Do they pay the ransom, or do they tend not to respond to the perpetrators' demands?

Despite strong recommendations not to pay the ransom, studies show that the majority of affected companies continue to do so. In 2024, around 76% of victims paid the ransom demanded, indicating the ongoing financial pressure of cyber incidents. However, there is an emerging trend that more and more companies are not paying the ransom. The reasons are:

• Improved backup strategies that allow recovery without payment.
• Legal and ethical considerations, as payment encourages criminal activity.
• Support from government and cybersecurity experts to help manage the issue.

If a company is successfully targeted by a ransomware attack, should it prioritize transparency by sharing details of the attack for the benefit of others, or is it more prudent to keep the incident confidential to protect its reputation?

In some situations, it may be mandatory to report an incident securely within the industry, for example the NIS2 regulation mandates that certain incidents must be disclosed. Additionally, if the targeted site believes that this could affect the wider sector there is an ethical responsibility to ensure details are shared securely within established communication channels to prevent a wider attack. The key takeaway from this is all around securely sharing information as to not damage the company reputation or provide further details to potential copycats, but to demonstrate responsibility for the situation and that matters are being taken seriously.

What are some of the most common mistake’s organizations still make when dealing with ransomware?

• Missing or inadequate backups: Failure to keep up-to-date or secure backups or leaving the backups upon the same system which is at risk of being targeted.
• Insufficient staff training: Employees do not recognize phishing emails.
• Outdated systems: Unpatched software provides an attack surface.
• No incident response plans: Lack of clarity on steps to take in the event of an attack.
• Paying the ransom: There's no guarantee that you'll get access to your data or computer, plus the attacker still has access to the stolen data and you're more likely to be targeted in the future.