Ransomware costs doubled in Q4 2019

Average ransom payments soared by 104% to $84,116, up from $41,198 in the quarter

Red skull and crossbones atop binary code

The cost of ransomware attacks more than doubled in Q4 2019, the latest research from Coveware has concluded, following a significant increase in Ryuk and Sodinokibi breaches.

The firm’s Q4 Ransomware Marketplace report, which collects anonymous ransomware data from cases handled by its Incident Response Platform, found that the average ransom payment increased by 104% to $84,116, up from $41,198 in Q3. The median ransom payment for the quarter was $41, 179.

This doubling of the average reflects the diversity of threats attacking businesses, Coveware said, with variants such as Ryuk and Sodinokibi moving into the large enterprise space to in order to extort seven-figure pay-outs. Ryuk payments, for example, were found to have hit a new high of $780, 000 for impacted businesses during the period.

Smaller firms also continued to be at risk, with ransomware as a service variants such as Dharma, Snatch and Netwalker blanketing the small business space with a high number of lower demands – sometimes as low as $1,500.

These malicious software threats are evolving, too, with ransomware attackers moving beyond just encrypting business data and adding the exfiltration of information and threat of its release if the sum is not paid.

In terms of data recovery, Q4 saw 98% of companies receiving a working decryption tool upon payment. Of that pool, victims managed to successfully decrypt 97% of their encrypted data; a slight increase over Q3.

It was also found that the average downtime for affected firms increased to 16.2 days, up from 12.1 days previously, driven by a “higher prevalence of attacks against larger enterprises” that have more complex networks to restore, Coveware said.

It also comes as a result of ransomware evolving and implanting more advanced features. In Q4, Ryuk actors introduced a “Wake-on-LAN” feature to turn on devices with a compromised network that were originally powered off.

Essentially, the addition allows attackers to infect machines during the night when the impact of security admins is limited, ultimately maximising the number of encrypted endpoints. Ransomware as a service variant Sodinokibi was discovered to be the most prevalent type attack during the quarter, making up 29.4% of the overall total. Sodinokibi only allows a select number of affiliates to distribute the ransomware, of which usually possess specific skills to attack targets such as managed service providers.

Once an MSP’s remote monitoring and management tools (RMM) are compromised, attackers can push the ransomware to every client endpoint it manages. Sodinokibi also adapted its extortion tactics to include threatening the release of data, Coveware added.

Related Resource

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now

“Sodinokibi’s focus on MSPs results in large payouts, but relatively small victims sizes, as most companies that utilise MSPs are small enterprises with less than 200 employees,” the firm added.

Businesses fell foul to a number of ransomware attack vectors in Q4, with the top three consisting of Remote Desktop Protocol (RDP) compromise (57.4%), email phishing (26.3%) and software vulnerabilities (12.9%).

Featured Resources

How virtual desktop infrastructure enables digital transformation

Challenges and benefits of VDI

Free download

The Okta digital trust index

Exploring the human edge of trust

Free download

Optimising workload placement in your hybrid cloud

Deliver increased IT agility with the cloud

Free Download

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Download now

Recommended

Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
US government warns of increased risk of ransomware over holiday season
ransomware

US government warns of increased risk of ransomware over holiday season

24 Nov 2021
Out-of-hours ransomware attacks have a greater impact on revenue
ransomware

Out-of-hours ransomware attacks have a greater impact on revenue

18 Nov 2021
US and Israel join forces to fight ransomware
ransomware

US and Israel join forces to fight ransomware

15 Nov 2021

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

6 Jan 2022
Dell XPS 15 (2021) review: The best just got better
Laptops

Dell XPS 15 (2021) review: The best just got better

14 Jan 2022
How to speed up Windows 11
Microsoft Windows

How to speed up Windows 11

7 Jan 2022