Russian-speaking criminal gangs are responsible for over 75% of crypto ransomware, new research announced at RSA Conference 2017 claims.
A total 47 of the 62 new crypto ransomware families discovered by Kaspersky Lab in 2016 can be tied to Russian-speaking groups or individuals. This conclusion is reportedly based on "observation of underground forums, command and control infrastructure, and other artefacts".
"It is hard to draw strong conclusions on why so many of the ransomware families out there have a Russian origin," wrote senior malware analyst Anton Ivanov in a SecureList blog, "but it is safe to say that this is because there are a lot of well-educated and skilled code writers in Russia and its neighboring countries."
Ivanov also cited the fact that Russia has a strong history of ransomware, linking the current epidemic to a wave of attacks from 2009 to 2011, which blocked access to browsers and operating systems in exchange for a fee. "The epidemic withered for a number of reasons," he said, "but it seems that experienced ransomware criminals haven't disappeared".
Other statistics revealed as part of the research include the fact that in Q3 2016, an individual was hit with a ransomware attack every ten seconds while a business was attacked every 40 seconds. Furthermore, one in five SMBs who ponied up the cash for the ransom still did not get their data decrypted.
The news comes at a time when fears of Russian hackers are at an all-time high. Debate still rages over whether or not Putin ordered state-sponsored hacks during the US election, and President Donald Trump's top national security advisor, Michael Flynn, resigned just this morning over leaks showing he had held discussions with the Russian ambassador over sanctions, before allegedly trying to cover the discussions up, though Flynn said he had accidentally misinformed the president over the nature of his talks.
-
What to look out for at RSAC Conference 2025Analysis Convincing attendees that AI can revolutionize security will be the first point of order at next week’s RSA Conference – but traditional threats will be a constant undercurrent
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reportedNews Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the lastNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field day
News February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
