IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Large US businesses are hackers' ideal ransomware targets

Research into dark web ads finds organizations in English-speaking countries are top targets

If you run a large, US-based non-health-care or -education company with revenue exceeding $100 million, then you will likely find yourself a victim of a ransomware attack.

These organizations are the most likely ransomware victims, according to a new report by cyber security firm Kela. 

Kela searched dark web forums for hackers wanting to buy access to organizations. It found 48 active threads where hackers claimed they wanted to buy different kinds of accesses. Of those hackers, 40% were involved in ransomware in some way or another.

Victoria Kivilevich, a threat intelligence analyst at Kela, said ransomware attackers appear to form “industry standards” defining an ideal victim based on its revenue and geography and excluding specific sectors and countries from the targets list. 

One of the hackers’ most basic requirements was network access such as RDP and VPN. The most common products mentioned were Citrix, Palo Alto Networks, VMware, Fortinet, and Cisco, according to Kivilevich.

She said that, on average, the actors active in July 2021 wanted to buy access to US companies with revenues exceeding $100 million. Almost half of them refused to buy access to companies in health care and education.

She added that the US was the most popular choice of hackers regarding victim location, as 47% of the actors mentioned it. Other top locations included Canada (37%), Australia (37%), and European countries (31%).

“Most of the advertisements included a call for multiple countries. The reason behind this geographical focus is that actors choose the wealthiest companies which are expected to be located in the biggest and the most developed countries,” she said.

The research found that the average minimum revenue ransomware attackers wanted was $100 million, but some stated the desired revenue depended on the location.

“For example, one of the actors described the following formula: revenue should be more than $5 million for US victims, more than $20 million for European victims, and more than $40 million for “the third world” countries,” said Kivilevich.

Related Resource

Nine traits you need to succeed as a cyber security leader

What characteristics and certifications make a successful cyber security leader?

Whitepaper front coverFree download

Almost half of ransomware-related threads included a blacklist of sectors, meaning the actors are not ready to buy access to companies from specific industries. 7% of ransomware attackers refused to buy access to companies from the health care and education industries. 37% prohibited compromising the government sector, and 26% claimed they would not purchase non-profit organizations access.

“When actors prohibit healthcare or non-profit industries offers, it is more likely due to the moral code of the actors. When the education sector is off the table, the reason is the same or the fact that education victims simply cannot afford to pay much,” she said.

“Finally, when actors refuse to target government companies, it is a precaution measure and an attempt to avoid unwanted attention from law enforcement.”

Unsurprisingly, Russian-speaking countries are off-limits for ransomware hackers, the research found.

“The actors based in CIS suppose that if they will not target these countries, local authorities will not hunt them,” she said.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

Protecting healthcare from cybercrime
Whitepaper

Protecting healthcare from cybercrime

25 May 2022
Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022
Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
RATDispenser evades nine in ten anti-virus engines
Security

RATDispenser evades nine in ten anti-virus engines

24 Nov 2021

Most Popular

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks
Security

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks

27 Jun 2022
Open source giant Red Hat joins HPE GreenLake ecosystem
automation

Open source giant Red Hat joins HPE GreenLake ecosystem

28 Jun 2022
Carnival hit with $5 million fine over cyber security violations
cyber security

Carnival hit with $5 million fine over cyber security violations

27 Jun 2022