thenextweb.com
Open in
urlscan Pro
2606:4700::6813:ae6f
Public Scan
URL:
https://thenextweb.com/news/why-ransomware-on-the-rise-syndication
Submission: On August 08 via api from GB — Scanned from GB
Submission: On August 08 via api from GB — Scanned from GB
Form analysis 2 forms found in the DOM
POST https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/7066311/e351b05b-2f78-4ba1-9669-4c1962a4924b
<form id="hsForm_e351b05b-2f78-4ba1-9669-4c1962a4924b" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/7066311/e351b05b-2f78-4ba1-9669-4c1962a4924b"
class="hs-form-private hsForm_e351b05b-2f78-4ba1-9669-4c1962a4924b hs-form-e351b05b-2f78-4ba1-9669-4c1962a4924b hs-form-e351b05b-2f78-4ba1-9669-4c1962a4924b_e970f9e7-c436-40e6-be4b-43520b9ad1a7 hs-form stacked channel-cta__ctaForm"
target="target_iframe_e351b05b-2f78-4ba1-9669-4c1962a4924b" data-instance-id="e970f9e7-c436-40e6-be4b-43520b9ad1a7" data-form-id="e351b05b-2f78-4ba1-9669-4c1962a4924b" data-portal-id="7066311">
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-e351b05b-2f78-4ba1-9669-4c1962a4924b" class="" placeholder="Enter your Your email address" for="email-e351b05b-2f78-4ba1-9669-4c1962a4924b"
style="display: none;"><span>Your email address</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input channel-cta__ctaField"><input id="channel-cta-email-input-field" name="email" required="" placeholder="Your email address" type="email" class="hs-input" inputmode="email" autocomplete="email" value=""></div>
</div>
<div class="legal-consent-container">
<div>
<div class="hs-dependent-field">
<div class="hs_LEGAL_CONSENT.subscription_type_56956815 hs-LEGAL_CONSENT.subscription_type_56956815 hs-fieldtype-booleancheckbox field hs-form-field">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input">
<ul class="inputs-list" required="">
<li class="hs-form-booleancheckbox"><label for="LEGAL_CONSENT.subscription_type_56956815-e351b05b-2f78-4ba1-9669-4c1962a4924b" class="hs-form-booleancheckbox-display"><input
id="LEGAL_CONSENT.subscription_type_56956815-e351b05b-2f78-4ba1-9669-4c1962a4924b" class="hs-input checkboxes" type="checkbox" name="LEGAL_CONSENT.subscription_type_56956815" value="true"><span>
<p>I agree to allow TNW to store and process my personal data</p><span class="hs-form-required">*</span>
</span></label></li>
</ul>
</div>
</div>
</div>
<legend class="hs-field-desc checkbox-desc" style="display: none;"></legend>
</div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
<div class="actions channel-cta__ctaButtonWrapper"><input type="submit" class="hs-button primary large channel-cta__ctaButton" value="SUBSCRIBE"></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1691530998546","formDefinitionUpdatedAt":"1665253943673","lang":"en","legalConsentOptions":"{\"communicationConsentCheckboxes\":[{\"communicationTypeId\":56956815,\"label\":\"<p>I agree to allow TNW to store and process my personal data</p>\",\"required\":true}],\"legitimateInterestLegalBasis\":\"LEGITIMATE_INTEREST_PQL\",\"processingConsentType\":\"IMPLICIT\",\"processingConsentCheckboxLabel\":\"<p>I agree to allow TNW to store and process my personal data.</p>\",\"isLegitimateInterest\":false}","embedType":"SHARABLE","clonedFromForm":"7d887d9e-bf62-4bdb-bab2-1b72d6c5c06a","renderRawHtml":"true","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36","pageTitle":"Why is ransomware on the rise?","pageUrl":"https://thenextweb.com/news/why-ransomware-on-the-rise-syndication","isHubSpotCmsGeneratedPage":false,"formTarget":"#latest-inarticle-embed","boolCheckBoxFields":"LEGAL_CONSENT.subscription_type_56956815","locale":"en","timestamp":1691530998650,"originalEmbedContext":{"portalId":"7066311","formId":"e351b05b-2f78-4ba1-9669-4c1962a4924b","region":"na1","target":"#latest-inarticle-embed","isBuilder":false,"isTestPage":false,"isPreview":false,"isMobileResponsive":true},"correlationId":"e970f9e7-c436-40e6-be4b-43520b9ad1a7","renderedFieldsIds":["email","LEGAL_CONSENT.subscription_type_56956815"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.3512","sourceName":"forms-embed","sourceVersion":"1.3512","sourceVersionMajor":"1","sourceVersionMinor":"3512","_debug_allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1691530998631,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"Why is ransomware on the rise?\",\"pageUrl\":\"https://thenextweb.com/news/why-ransomware-on-the-rise-syndication\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1691530998633,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"GB\""}]}"><iframe
name="target_iframe_e351b05b-2f78-4ba1-9669-4c1962a4924b" style="display: none;"></iframe>
</form>POST https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/7066311/ea75c45e-64ca-4ac5-acfa-5e99d4ae4ba4
<form id="hsForm_ea75c45e-64ca-4ac5-acfa-5e99d4ae4ba4" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/7066311/ea75c45e-64ca-4ac5-acfa-5e99d4ae4ba4"
class="hs-form-private hsForm_ea75c45e-64ca-4ac5-acfa-5e99d4ae4ba4 hs-form-ea75c45e-64ca-4ac5-acfa-5e99d4ae4ba4 hs-form-ea75c45e-64ca-4ac5-acfa-5e99d4ae4ba4_3e886fad-dbb1-4e44-b93a-22af0f6bceeb hs-form stacked c-channel__ctaForm"
target="target_iframe_ea75c45e-64ca-4ac5-acfa-5e99d4ae4ba4" data-instance-id="3e886fad-dbb1-4e44-b93a-22af0f6bceeb" data-form-id="ea75c45e-64ca-4ac5-acfa-5e99d4ae4ba4" data-portal-id="7066311">
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-ea75c45e-64ca-4ac5-acfa-5e99d4ae4ba4" class="" placeholder="Enter your Your email address" for="email-ea75c45e-64ca-4ac5-acfa-5e99d4ae4ba4"
style="display: none;"><span>Your email address</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input c-channel__ctaField channelCta c-channel__ctaInput c-channel__ctaInput__hubspotInput c-input c-input--borderless"><input id="email-input-field" name="email" required="" placeholder="you@email.com" type="email"
class="hs-input emailField" inputmode="email" autocomplete="email" value="">
<div class="actions"><input type="submit" class="hs-button primary large submitBtnChannel" value="SUBSCRIBE"></div>
</div>
</div>
<div class="legal-consent-container">
<div>
<div class="hs-dependent-field">
<div class="hs_LEGAL_CONSENT.subscription_type_56956815 hs-LEGAL_CONSENT.subscription_type_56956815 hs-fieldtype-booleancheckbox field hs-form-field">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input">
<ul class="inputs-list" required="">
<li class="hs-form-booleancheckbox consentDiv"><label for="LEGAL_CONSENT.subscription_type_56956815-ea75c45e-64ca-4ac5-acfa-5e99d4ae4ba4" class="hs-form-booleancheckbox-display"><input
id="LEGAL_CONSENT.subscription_type_56956815-ea75c45e-64ca-4ac5-acfa-5e99d4ae4ba4" class="hs-input checkboxes" type="checkbox" name="LEGAL_CONSENT.subscription_type_56956815" value="true"><span>
<p>I agree to allow TNW to store and process my personal data</p>
<p>*</p><span class="hs-form-required">*</span>
</span></label></li>
</ul>
</div>
</div>
</div>
<legend class="hs-field-desc checkbox-desc" style="display: none;"></legend>
</div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1691530998563","formDefinitionUpdatedAt":"1665253962033","lang":"en","legalConsentOptions":"{\"communicationConsentCheckboxes\":[{\"communicationTypeId\":56956815,\"label\":\"<p>I agree to allow TNW to store and process my personal data</p>\\n<p>*</p>\",\"required\":true}],\"legitimateInterestLegalBasis\":\"LEGITIMATE_INTEREST_PQL\",\"processingConsentType\":\"IMPLICIT\",\"processingConsentCheckboxLabel\":\"<p>I agree to allow TNW to store and process my personal data.</p>\",\"isLegitimateInterest\":false}","embedType":"SHARABLE","clonedFromForm":"e351b05b-2f78-4ba1-9669-4c1962a4924b","renderRawHtml":"true","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36","pageTitle":"Why is ransomware on the rise?","pageUrl":"https://thenextweb.com/news/why-ransomware-on-the-rise-syndication","isHubSpotCmsGeneratedPage":false,"formTarget":"#in-article-newsletter","boolCheckBoxFields":"LEGAL_CONSENT.subscription_type_56956815","locale":"en","timestamp":1691530998691,"originalEmbedContext":{"portalId":"7066311","formId":"ea75c45e-64ca-4ac5-acfa-5e99d4ae4ba4","region":"na1","target":"#in-article-newsletter","isBuilder":false,"isTestPage":false,"isPreview":false,"isMobileResponsive":true},"correlationId":"3e886fad-dbb1-4e44-b93a-22af0f6bceeb","renderedFieldsIds":["email","LEGAL_CONSENT.subscription_type_56956815"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.3512","sourceName":"forms-embed","sourceVersion":"1.3512","sourceVersionMajor":"1","sourceVersionMinor":"3512","_debug_allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1691530998681,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"Why is ransomware on the rise?\",\"pageUrl\":\"https://thenextweb.com/news/why-ransomware-on-the-rise-syndication\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1691530998682,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"GB\""}]}"><iframe
name="target_iframe_ea75c45e-64ca-4ac5-acfa-5e99d4ae4ba4" style="display: none;"></iframe>
</form>Text Content
Skip to content
Toggle Navigation
* News
* Events
* TNW Conference 2023 June 16 & 17, 2022
* TNW València 2024
* All events
* Spaces
* Programs
--------------------------------------------------------------------------------
* Newsletters
* Partner with us
*
*
*
*
*
*
* Jobs
* Contact
The Next Web News news news news
* Latest
* Deep tech
* Sustainability
* Ecosystems
* Data and security
* Fintech and ecommerce
* Future of work
* More
* Startups and technology
* Investors and funding
* Government and policy
* Corporates and innovation
* Gadgets & apps
This article was published on June 22, 2021
* Tech
WHY IS RANSOMWARE ON THE RISE?
Attacks have become more lucrative and easier to execute thanks to corporate
inaction and the growing ransomware industry
June 22, 2021 - 8:54 am
Image by: Scale by Flexiple
Two high-profile cyberattacks on critical infrastructure companies over the past
month have shone what experts say is a much-needed spotlight on the rising
threat of ransomware.
An attack against Colonial Pipeline in May forced the company to temporarily
shut down 5,500 miles of pipeline that it said supplies nearly 45 percent of the
East Coast’s fuel. Colonial eventually paid the extortionists—a group known as
DarkSide—nearly $5 million in Bitcoin. The FBI has since recovered roughly half
of the ransom. Colonial confirmed the attack and thanked the FBI for its efforts
in a statement.
Just weeks later, another ransomware attack, credited to the group REvil, struck
JBS, the world’s largest meat supplier, forcing the company to close plants
across the U.S. and Australia and pay approximately $11 million in ransom.
The <3 of EU tech
The latest rumblings from the EU tech scene, a story from our wise ol' founder
Boris, and some questionable AI art. It's free, every week, in your inbox. Sign
up now!
Your email address*
* I agree to allow TNW to store and process my personal data
*
(The values of the ransoms referenced in this story have changed over the course
of the media’s coverage of the incidents because they were paid in Bitcoin, a
highly volatile cryptocurrency.)
Ransomware is a type of malicious software, or malware, that encrypts files on a
computer or network and holds them hostage until the owner pays the attacker the
requested fee. It’s an old racket—what’s widely considered to be the first
example of ransomware came in 1989, when malware was delivered via floppy discs
to attendees at a World Health Organization AIDS conference.
So in some respects, the attacks against Colonial Pipeline and JBS are nothing
new. Thousands of companies are targeted by ransomware each year, and many end
up paying to recover their data. But cybersecurity researchers say these two
attacks are indicative of how the ransomware threat is morphing—driven by a
combination of economic factors and years of corporate secrecy and inaction.
“Americans, I think for the first time at the actual consumer level, saw the
impact of these ransomware attacks,” said Adam Meyers, vice president of
intelligence for cybersecurity firm CrowdStrike. “Organizations can’t stick
their heads in the sand and hope this is going away. They need to invest and
start taking this seriously.”
IS RANSOMWARE ON THE RISE?
Certainly, the companies that make money from selling cybersecurity services
report a rise in ransomware.
The cybersecurity firm SonicWall detected more than 304 million attempted
ransomware attacks in 2020, a 62 percent increase over 2019. During the first
five months of this year, the company tracked a 116 percent increase in
ransomware attempts compared to the same period in 2020, and the 62.3 million
attacks it detected this May were the most it has ever recorded in a single
month, said Dmitriy Ayrapetov, vice president of platform architecture for
SonicWall.
Most of those attacks are likely aimed at victims of opportunity—the perpetrator
may send out waves of phishing emails at random hoping for just one or two
victims to take the bait. But targeted attacks against corporations and
government entities are also on the rise, Meyers and other cybersecurity
researchers said.
CrowdStrike monitors organized criminal groups that are more intentional in
selecting their targets, what the company calls “big game hunters.” In 2020, the
firm recorded at least 1,377 big game hunter infections. So far in 2021,
CrowdStrike has recorded 1,024 such attacks, Meyers said, with an average ransom
demand of $5.6 million.
But it’s hard to truly quantify the number of attacks, the type of targets, and
the damage done. There’s no comprehensive data source for ransomware attacks.
The data we do have is either self-reported (and many companies and individuals
don’t report) or comes from cybersecurity firms that profit by selling
protections against attacks and are therefore keen to publish reports
demonstrating the severity of the situation.
The FBI requests that organizations affected by ransomware report incidents so
that the agency can better piece together trends. The agency’s numbers actually
show a decline in incidents but a rapid rise in damages. In 2016, there were
2,673 self-reported incidents resulting in $2.4 million in adjusted losses,
according to the FBI’s annual data. That dropped to 1,783 incidents causing
$2.3 million in losses in 2017, then 1,493 incidents causing $3.6 million in
losses in 2018. In 2019, there were 2,047 reported incidents and $8.9 million in
losses, and in 2020 the FBI recorded 2,474 incidents and $29.1 million in
losses.
The FBI’s numbers are almost certainly vast undercounts because many businesses
decide not to publicly disclose successful ransomware attacks in order to
protect their reputations with shareholders and customers.
WHY IS RANSOMWARE ON THE RISE?
The pandemic certainly increased many organizations’ vulnerability to
ransomware, experts said. Especially during the early days of work from home,
when many employees were forced to use their own equipment, company and
government systems were being accessed on personal computers that were also used
for any number of other potentially risky activities, from playing online games
to surfing the web.
The rising value of Bitcoin, cyber criminals’ preferred form of payment, over
the last year has also added to the attractiveness of ransomware.
But there are two changes within the ransomware industry—because that’s what it
is now—that experts say have been driving the increase in attacks since before
the pandemic.
“One of the causes of the recent increases we’re seeing in ransomware is that
they’ve pivoted,” said Darren Shou, the chief technology officer for
NortonLifeLock. “Instead of just being a threat where they lock down access to
your data, now there’s a dual-threat where if you don’t pay that ransom they
threaten to release your data.”
The Babuk ransomware group recently targeted Washington, D.C.’s Metropolitan
Police Department with this type of attack. After the department declined to pay
the requested $4 million ransom (it did allegedly offer to pay $100,000), the
group published hundreds of embarrassing pages from MPD officers’ background
investigations. The added threat of embarrassment and liability from having
sensitive data published increases the potential financial pain for victims,
making them more likely to pay ransoms. The more ransoms get paid, the more
likely ransomware attacks become.
The second major change is the emergence of “ransomware as a service,” or RaaS.
In addition to launching their own attacks, the most sophisticated ransomware
groups are increasingly offering to sell their tools to aspiring criminals as a
bundle, providing not just the malware but also the phishing operation, payment
platform, and premade data leak site.
The Colonial Pipeline attack perpetrated by DarkSide appears to have been an
RaaS operation. Following the immediate flurry of news about the pipeline’s
shutdown, which brought unwanted attention to the group, DarkSide published a
statement on its website (on the dark web) saying “from today we introduce
moderation and check each company that our partners want to encrypt to avoid
social consequences in the future.”
“[RaaS] really lowers the barrier of entry into this business,” Ayrapetov said.
“It’s a natural kind of evolution of a business model, and you get more scale
that way. As this scales, there are more players who might be more reckless.”
WHAT CAN BE DONE?
Cybersecurity experts say the solutions are widely known—they’re just not widely
implemented.
Organizations need to educate their employees about phishing and social
engineering attacks, but there are also some technical and infrastructure
changes that can make a big difference, experts said.
Not everyone needs to have administrator access to their own computer, and
organizations should segment their networks to ensure employees can only access
the parts they need for their jobs.
On top of that, companies should maintain air-gapped copies of their
data—regularly updated backups that aren’t connected to the network and are
therefore immune to ransomware encryption. They should also be using multifactor
authentication and ensuring that they’re implementing software patches as soon
as the patches are released.
Some of the economic factors spurring ransomware fears—including the insurance
industry that profits from them—have also led to more controversial proposals.
The Government Accountability Office reported that the percentage of companies
paying for cyber insurance nearly doubled from 2016 to 2020. And as attacks and
ransom demands increased, the premiums for those plans went up by as much as
30 percent between 2017 and 2020, while the amount those insurers promised to
cover in damages for some sectors went down.
Adam Wandt, a professor at John Jay College of Criminal Justice who researches
cybercrime, said the security blanket of cyber insurance has convinced some
organizations they don’t need to implement the human and technical changes
necessary to stop ransomware attacks, and that the only real long-term answer is
for governments to pass laws banning organizations from paying ransoms for
certain kinds of data.
The FBI already urges organizations not to pay, but in some cases not paying
means going out of business.
“Ransoms should never be paid and those that do should understand the damage
they’re causing to our society for their own benefit and gain,” Wandt said,
acknowledging that such laws could initially be devastating to victims. “Paying
the ransom will lead to nothing more than more attacks on our critical
infrastructure.”
This article by Todd Feathers was originally published on The Markup and was
republished under the Creative Commons Attribution-NonCommercial-NoDerivatives
license.
STORY BY THE MARKUP
GET THE TNW NEWSLETTER
Get the most important tech news in your inbox each week.
Your email address*
* I agree to allow TNW to store and process my personal data
*
*
ALSO TAGGED WITH
* Attack (computing)
* cyberattacks
* Cybersecurity
Published June 22, 2021 - 8:54 am UTC
Back to top
Story by The Markup
POPULAR ARTICLES
1. 1
TAIWAN TAPS EUROPEAN SATELLITE FIRMS TO PROTECT WARTIME COMMUNICATIONS
2. 2
THE CAREER CROSSROADS: 6 SIGNS YOU’VE OUTGROWN YOUR JOB
3. 3
ESA SATELLITES CAPTURE THE EXTENT OF EUROPE’S WILDFIRES
4. 4
NORWAY FINES META 1 MILLION CROWNS PER DAY OVER DATA HARVESTING FOR
BEHAVIOURAL ADS
5. 5
GERMANY’S MARVEL FUSION TO BUILD $150M LASER FACILITY IN US
RELATED ARTICLES
security
THE NEXT BIG CYBERSECURITY THREAT IS CONNECTED SAAS PLATFORMS
future of work
WHITE HAT HACKING PAYS BANK — COULD IT BE RIGHT CAREER FOR YOU?
JOIN TNW ALL ACCESS
Watch videos of our inspiring talks for free → Sign up now
future of work
SO YOU WANT TO GET INTO CYBERSECURITY? HERE’S HOW
security
THE NIGERIAN PRINCE HAS EVOLVED: EMAIL SCAMS NOW EVEN FOOL CYBERSECURITY EXPERTS
The heart of tech
*
*
*
*
*
*
*
MORE TNW
* Media
* Events
* Programs
* Spaces
* Newsletters
* Deals
* Jobs in tech
ABOUT TNW
* Partner with us
* Jobs
* Terms & Conditions
* Cookie Statement
* Privacy Statement
* Editorial Policy
* Masthead
Copyright © 2006—2023, The Next Web B.V. Made with <3 in Amsterdam.
COOKIES
We use cookies and other data for a number of reasons, such as keeping TNW sites
reliable and secure, personalizing content and ads, providing social media
features and to analyze how our sites are used.
Accept & continueManage cookies