One of many largest ransomware payouts that’s turn out to be public was reported Tuesday by cloud safety agency Zscaler.
The US$75 million fee made to the Darkish Angels ransomware group was found by Zscaler’s safety analysis arm ThreatLabz earlier this yr, in accordance with the corporate’s annual ransomware report, which covers a interval from April 2023 to April 2024.
Zscaler didn’t disclose the title of the corporate that paid the ransom.
“Darkish Angels operates in a different way than most different ransomware teams,” noticed Zscaler’s Director of Risk Intelligence Brett Stone-Gross.
“As a substitute of outsourcing assaults to associates, they’re launching the assaults and doing it at a a lot smaller scale,” he informed TechNewsWorld. “As a substitute of focusing on dozens or tons of of firms, they’re going after very massive firms separately.”
The group additionally departs from the modus operandi of most of its friends in one other approach. “They steal a considerable amount of information, however they need to keep away from enterprise disruption,” Stone-Gross stated. “They need to keep out of the headlines as a result of it reduces the quantity of scrutiny they’ll get from regulation enforcement and researchers.”
The Darkish Angels ransomware group’s technique of focusing on a small variety of high-value firms for big payouts is a pattern value monitoring, the report famous.
Zscaler ThreatLabz predicted that different ransomware teams will pay attention to Darkish Angels’ success and will undertake related ways. To maximise their monetary positive factors, they’ll concentrate on high-value targets and improve the importance of knowledge theft.
Knowledge theft has already turn out to be a part of the sport plan of many ransomware actors, added Steve Stone, head of Zero Labs at Rubrik, a world information safety and backup software program firm. “Ransomware actors aren’t simply encrypting environments and asking for a ransom,” he informed TechNewsWorld. “They’re doing that and stealing information to allow them to make an extortion demand. It’s successfully a double ransom.”
Rising Menace
Zscaler additionally reported that the variety of ransomware assaults blocked by its cloud elevated by 17.8% throughout the reporting interval, and the variety of extorted firms on information leak websites grew by 57.8% in the identical interval, regardless of quite a few regulation enforcement operations, together with the seizure of infrastructure, arrests, prison indictments, and sanctions.
Chris Morales, CISO at Netenrich, a safety operations middle providers supplier in San Jose, Calif., recognized a number of elements contributing to the expansion of ransomware. They embody expanded assault surfaces as a result of distant work and cloud adoption, extra refined ransomware assaults usually involving information exfiltration and the democratization of assault instruments via ransomware-as-a-service.
“We’re additionally seeing larger-scale breaches affecting tens of millions of customers without delay,” he informed TechNewsWorld. “This surge not solely highlights the pressing want for a paradigm shift in safety operations, but it surely additionally underscores the necessity for speedy motion, transferring in the direction of extra proactive, data-driven methods.”
“We anticipate breaches and ransomware assaults to proceed growing within the second half of 2024, particularly focusing on healthcare, manufacturing, essential infrastructure, and provide chains,” added Stephen Kowski, subject CTO at SlashNext, a pc and community safety firm in Pleasanton, Calif.
“Current high-profile incidents, such because the well being care and automotive dealership vendor hacks, spotlight the continued vulnerabilities,” he informed TechNewsWorld. “To fight this, organizations must concentrate on strengthening e-mail safety, implementing zero-trust architectures, and enhancing risk detection and response capabilities.”
High Sector Targets
Manufacturing, well being care, and expertise had been the highest sectors focused by ransomware assaults, in accordance with the report, whereas the power sector skilled a 500% year-over-year spike as essential infrastructure and susceptibility to operational disruptions make it notably enticing to cybercriminals.
Among the many high targets for cyber extortion, manufacturing led the pack. It was focused greater than twice as a lot as some other business.
“Many manufacturing organizations have been round for a very long time, and there’s loads of legacy habits that don’t serve them effectively in terms of ransomware,” famous Stone of Zero Labs.
Marcus Fowler, CEO of Darktrace Federal, a world cybersecurity AI firm, defined that essential infrastructure suppliers and manufacturing firms are more and more pursuing data expertise and operational expertise convergence as the information assortment and evaluation advantages can dramatically enhance manufacturing effectivity, upkeep, and scaling.
“With IT/OT convergence increasing assault surfaces, safety personnel have elevated workloads that make it tough to maintain tempo with threats and vulnerabilities,” he informed TechNewsWorld.
“The manufacturing business has been present process vital digitization so as to turn out to be extra agile and environment friendly,” added Rogier Fischer, CEO of Hadrian, the maker of an automatic, event-based scanning answer in Amsterdam.
“The draw back is that processes that had been successfully air-gapped are actually linked to company IT programs,” he informed TechNewsWorld. “The interconnectivity of OT and IT environments, together with the traditionally much less cyber-aware manufacturing business, makes the sector a pretty goal.”
Want for Zero Belief
Zscaler’s Chief Safety Officer Deepen Desai maintains that ransomware protection stays a high precedence for CISOs in 2024. “The growing use of ransomware-as-a-service fashions, together with quite a few zero-day assaults on legacy programs, an increase in vishing assaults, and the emergence of AI-powered assaults, has led to record-breaking ransom funds,” he stated in an announcement.
“Organizations should prioritize zero belief structure to strengthen their safety posture towards ransomware assaults,” Desai added.
Fischer famous that zero belief is a part of a mindset shift. “It’s going from the reactive ‘how can I detect an assault underway’ or ‘how can I reply to an incident’ to a proactive ‘how can I preserve dangerous actors out.’ Zero belief and offensive safety rules assist organizations mitigate cyber threat proactively.”
Cybersecurity prioritization and funding earlier than a cybercriminal strike is essential for organizations of all sizes, added Anne Cutler, a cybersecurity evangelist at Keeper Safety, a password administration and on-line storage firm in Chicago.
“A zero-trust safety mannequin with least privileged entry and robust information backups will restrict the blast radius if a cyberattack happens,” she informed TechNewsWorld. “Moreover, sturdy identification and entry administration on the entrance finish will assist stop the commonest cyberattacks that may result in a disastrous information breach.”
Nevertheless, Steve Hahn, govt vp for the Americas of BullWall, a supplier of ransomware containment, safety, and mitigation options in Denmark, cautioned that whereas zero belief will definitely reduce the possibilities of an assault, the journey is usually very lengthy for purchasers and nonetheless not a silver bullet.
“Zero-day assaults, shadow IT, private units, IoT units, these are all assault vectors for ransomware,” he informed TechNewsWorld, “and as soon as the encryption begins on the shared drives, whether or not these are cloud or native, it’s solely a matter of time earlier than all the information is encrypted, even with zero-trust community structure in place.”
