IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Europol reveals how ransomware gangs are evolving to evade capture

The annual crime report explains how ransomware continues to grow in profitability despite recent capture attempts, and the novel ways DDoS attackers are attacking businesses

Ransomware gangs are continuing to profit on the business model as they develop new attack methodologies to evade law enforcement, Europol said on Thursday.

The European law enforcement agency released its annual Internet Organised Crime Threat Assessment (IOCTA) which revealed the latest cyber security trends that organisations in the region should be aware of for the coming year, including novel approaches to ransomware and DDoS attacks.

Europol claimed ransomware will continue to proliferate across the continent but the industry can expect to see more restrictions placed on who or what type of organisations are targeted.

Citing recent pressures and successful stings from law enforcement agencies, Europol said attacks will be focused more on private corporations than those in the public sector, and that targets are likely to be chosen based on how much negative press or public outcry might be created following an attack.

There have been a number of instances where ransomware gangs have changed their policies on target selection, Europol said. For example, DarkSide stated it would introduce moderation after the Colonial Pipeline attack drew global attention.

Avaddon also introduced measures to avoid targets in the Commonwealth of Independent States, and REvil has prohibited attacks on social and governmental services of any country.

A number of ransomware groups have claimed to have ceased operation in recent months. Avaddon said in July that it would follow in the footsteps of DarkSide and Maze in ending their campaigns, while most recently BlackMatter also announced that it too would be shuttering, citing increased pressure from law enforcement agencies.

It raises the question as to whether these groups will actually end their attacks for good or whether they are laying low until the pressure from law enforcement, the public, and the industry is quelled. The BlackMatter a group, for example, is itself believed to be a spin-off of DarkSide and REvil, suggesting that it hackers may rebranding in order to restart their hacking campaigns.

Related Resource

The best defence against ransomware

How ransomware is evolving and how to defend against it

Blue padlock Free download

Europol also reported that "double extortion" methods are once again on the rise, having received numerous reports this year. Double extortion has been gaining traction since 2020 but a number of new techniques have been recently observed. This includes voice over internet protocol (VoIP) services being used to call journalists following a ransomware attack to further coerce them into paying.

There have also been cases of attackers threatening victims with further DDoS attacks and leaking of information should a ransom not be paid, according to the report.

The evolving techniques and a restricted approach to targeting victims has led to 300%+ increase in ransom payments being made compared to the period between 2019 and 2020.

The IOCTA report also highlighted the re-emergence of monetarily-driven distributed denial of service attacks (DDoS) - knocking organisations' networks offline before demanding a payment.

More instances have been observed by the EU's law enforcement agency of cyber criminals launching small-scale DDoS attacks on their targets, showing them the damage they're capable of, then stopping to contact and demand a ransom payment.

The results of this attack vector have been mixed, Europol said, and those responsible have been claiming to be members of known advanced persistent threat (APT) groups to scare the victim further into paying.

The types of organisations having been targeted using this method include financial services institutions, internet service providers (ISPs), and small and medium-sized businesses (SMBs).

"This is further evidence of how much of a threat ransom attacks pose to businesses, including those that go beyond ransomware," said Chris Waynforth, assistant vice president of Northern Europe at Imperva. "Our research has seen a surge in ransom-focused DDoS attacks, partly because they can be even easier to carry out than ransomware attacks.

"It’s no coincidence that the number of DDoS attacks has quadrupled in the last year," he added. "Using rapid-fire attacks, averaging just 6 minutes, cyber-criminals demonstrate their capabilities to businesses before sending an extortion demand, threatening much larger attacks if payments aren’t made."

The final major threat Europol drew attention to was mobile-based malware which, the agency said, has previously not been as effective as attackers may have hoped. Despite this, the number of reports have increased significantly.

FluBot is named as one of the most prolific mobile banking trojans currently in circulation across Europe and the US. FluBot's main functionality includes setting invisible overlays that work on various banking apps in order to steal login credentials.

Other malware strains such as Cerberus and TeaBot are also able to intercept SMS-based one-time passcodes sent by financial institutions and two-factor authentication (2FA) codes from apps like Google Authenticator.

"Cybercrime is a reality and law enforcement worldwide needs to catch up,” said Edvardas Šileris, head of Europol’s European Cybercrime Centre. "Events like this bring together public and private entities in recognising the threat and identifying ways to combat it effectively. Only by working together can we create innovative ideas and practical approaches that can put a halt to cybercrime acceleration. It is essential to establish the environment and resources required to do so."

Featured Resources

IT best practices for accelerating the journey to carbon neutrality

Considerations and pragmatic solutions for IT executives driving sustainable IT

Free Download

The Total Economic Impact™ of IBM Spectrum Virtualize

Cost savings and business benefits enabled by storage built with IBMSpectrum Virtualize

Free download

Using application migration and modernisation to supercharge business agility and resiliency

Modernisation can propel your digital transformation to the next generation

Free Download

The strategic CFO

Why finance transformation propels business value

Free Download


SOC modernisation and and the role of XDR

SOC modernisation and and the role of XDR

16 Mar 2023
Uber says compromised third-party to blame for data breach
data breaches

Uber says compromised third-party to blame for data breach

13 Dec 2022
Microsoft: Russia increasingly timing cyber attacks with missile strikes in Ukraine
cyber warfare

Microsoft: Russia increasingly timing cyber attacks with missile strikes in Ukraine

5 Dec 2022
Major security exploits expected to rise before New Year

Major security exploits expected to rise before New Year

1 Nov 2022

Most Popular

The big PSTN switch off: What’s happening between now and 2025?

The big PSTN switch off: What’s happening between now and 2025?

13 Mar 2023
Pension Protection Fund confirms employee data exposed in GoAnywhere breach

Pension Protection Fund confirms employee data exposed in GoAnywhere breach

24 Mar 2023
Some GitHub users must take action after RSA SSH host key exposed

Some GitHub users must take action after RSA SSH host key exposed

24 Mar 2023