Ransomware costs doubled in Q4 2019

The cost of ransomware attacks more than doubled in Q4 2019, the latest research from Coveware has concluded, following a significant increase in Ryuk and Sodinokibi breaches.

The firm’s Q4 Ransomware Marketplace report, which collects anonymous ransomware data from cases handled by its Incident Response Platform, found that the average ransom payment increased by 104% to $84,116, up from $41,198 in Q3. The median ransom payment for the quarter was $41, 179.

This doubling of the average reflects the diversity of threats attacking businesses, Coveware said, with variants such as Ryuk and Sodinokibi moving into the large enterprise space to in order to extort seven-figure pay-outs. Ryuk payments, for example, were found to have hit a new high of $780, 000 for impacted businesses during the period.

Smaller firms also continued to be at risk, with ransomware as a service variants such as Dharma, Snatch and Netwalker blanketing the small business space with a high number of lower demands – sometimes as low as $1,500.

These malicious software threats are evolving, too, with ransomware attackers moving beyond just encrypting business data and adding the exfiltration of information and threat of its release if the sum is not paid.

In terms of data recovery, Q4 saw 98% of companies receiving a working decryption tool upon payment. Of that pool, victims managed to successfully decrypt 97% of their encrypted data; a slight increase over Q3.

It was also found that the average downtime for affected firms increased to 16.2 days, up from 12.1 days previously, driven by a “higher prevalence of attacks against larger enterprises” that have more complex networks to restore, Coveware said.

It also comes as a result of ransomware evolving and implanting more advanced features. In Q4, Ryuk actors introduced a “Wake-on-LAN” feature to turn on devices with a compromised network that were originally powered off.

Essentially, the addition allows attackers to infect machines during the night when the impact of security admins is limited, ultimately maximising the number of encrypted endpoints.

Ransomware as a service variant Sodinokibi was discovered to be the most prevalent type attack during the quarter, making up 29.4% of the overall total. Sodinokibi only allows a select number of affiliates to distribute the ransomware, of which usually possess specific skills to attack targets such as managed service providers.

Once an MSP’s remote monitoring and management tools (RMM) are compromised, attackers can push the ransomware to every client endpoint it manages. Sodinokibi also adapted its extortion tactics to include threatening the release of data, Coveware added.

“Sodinokibi’s focus on MSPs results in large payouts, but relatively small victims sizes, as most companies that utilise MSPs are small enterprises with less than 200 employees,” the firm added.

Businesses fell foul to a number of ransomware attack vectors in Q4, with the top three consisting of Remote Desktop Protocol (RDP) compromise (57.4%), email phishing (26.3%) and software vulnerabilities (12.9%).