IBM: Ransomware incidents "exploded" in June
IBM Security X-Force report also finds that ransom demands are increasing to as much as $40 million


IBM says ransomware incidents "exploded" in June 2020, which saw twice as many ransomware attacks as the month prior.
The month of June accounted for one-third of all the ransomware attacks dealt with by IBM Security X-Force Incident Response this year so far, according to new findings published this week.
According to the report, one in four cyber security incidents in 2020 so far had been caused by ransomware, and IBM warns that ransom demands are also rapidly increasing, with some demands surpassing $40 million (£31 million).
Out of all ransomware attacks IBM observed, 29% were made up of the Sodinokibi (also known as REvil) ransomware-as-a-service (RaaS) attack model, which previously targeted entertainment and media law firm Grubman Shire Meiselas and Sacks.
In May, attackers claimed to have used the ransomware strain to compromise 756GB of data including contracts and personal emails belonging to high-profile celebrities such as Madonna, Lady Gaga and Bruce Springsteen.
Sodinokibi was also used in the January attack on foreign exchange company Travelex, which was kept offline for weeks and reportedly cost the firm £25 million.
IBM Security X-Force found that Sodinokibi had managed to attack over 140 organisations since its emergence in April 2019, most often targeting industries such as the wholesale sector (19%), manufacturing (18%) and professional services (16%).
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Three in five of the targeted organisations were based in the US, followed by the UK, Australia, and Canada.
According to the findings, over 36% of Sodinokibi victims decided to pay the ransom, and 12% of victims had their sensitive data sold in an auction on the dark web for prices ranging from $5,000 to more than $20 million.
IBM Security X-Force also managed to identify which cyber crime threat group is behind the elusive malware.
In a blog post detailing the findings, X-Force IRIS global security intelligence analyst Camille Singleton said that the team found “evidence suggesting that ITG14 — which shares campaign overlap with FIN7 — is at least one affiliate group connected to these attacks”.
“After investigating a Carbanak backdoor associated with a Sodinokibi ransomware attack, we discovered this Carbanak sample was similar to new Carbanak 64-bit variants, which have been connected to ITG14 tools and techniques. We also assess this sample is used exclusively by the group. This leads us to conclude that ITG14 is at least one affiliate group that contracts with Sodinokibi RaaS providers to deliver these attacks,” she explained.
IBM recommendeds that, in order to mitigate the risks of ransomware, companies should establish and maintain offline file backups, implement a strategy to prevent unauthorized data theft, employ multi-factor authentication and user behavior analytics, and conduct penetration testing to identify vulnerabilities.
Having only graduated from City University in 2019, Sabina has already demonstrated her abilities as a keen writer and effective journalist. Currently a content writer for Drapers, Sabina spent a number of years writing for ITPro, specialising in networking and telecommunications, as well as charting the efforts of technology companies to improve their inclusion and diversity strategies, a topic close to her heart.
Sabina has also held a number of editorial roles at Harper's Bazaar, Cube Collective, and HighClouds.
-
Cloudflare is cracking down on AI web scrapers
News Cloudflare CEO Matthew Prince said AI companies have been "scraping content without limits" - now the company is cracking down.
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
News An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs
-
It's been a bad week for ransomware operators
News A host of ransomware strains have been neutralized, servers seized, and key players indicted
-
Everything we know about the Peter Green Chilled cyber attack
News A ransomware attack on the chilled food distributor highlights the supply chain risks within the retail sector
-
Scattered Spider: Who are the alleged hackers behind the M&S cyber attack?
News The Scattered Spider group has been highly active in recent years
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reported
News Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.