IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Large US businesses are hackers' ideal ransomware targets

Research into dark web ads finds organizations in English-speaking countries are top targets

If you run a large, US-based non-health-care or -education company with revenue exceeding $100 million, then you will likely find yourself a victim of a ransomware attack.

These organizations are the most likely ransomware victims, according to a new report by cyber security firm Kela. 

Kela searched dark web forums for hackers wanting to buy access to organizations. It found 48 active threads where hackers claimed they wanted to buy different kinds of accesses. Of those hackers, 40% were involved in ransomware in some way or another.

Victoria Kivilevich, a threat intelligence analyst at Kela, said ransomware attackers appear to form “industry standards” defining an ideal victim based on its revenue and geography and excluding specific sectors and countries from the targets list. 

One of the hackers’ most basic requirements was network access such as RDP and VPN. The most common products mentioned were Citrix, Palo Alto Networks, VMware, Fortinet, and Cisco, according to Kivilevich.

She said that, on average, the actors active in July 2021 wanted to buy access to US companies with revenues exceeding $100 million. Almost half of them refused to buy access to companies in health care and education.

She added that the US was the most popular choice of hackers regarding victim location, as 47% of the actors mentioned it. Other top locations included Canada (37%), Australia (37%), and European countries (31%).

“Most of the advertisements included a call for multiple countries. The reason behind this geographical focus is that actors choose the wealthiest companies which are expected to be located in the biggest and the most developed countries,” she said.

The research found that the average minimum revenue ransomware attackers wanted was $100 million, but some stated the desired revenue depended on the location.

“For example, one of the actors described the following formula: revenue should be more than $5 million for US victims, more than $20 million for European victims, and more than $40 million for “the third world” countries,” said Kivilevich.

Related Resource

Nine traits you need to succeed as a cyber security leader

What characteristics and certifications make a successful cyber security leader?

Whitepaper front coverFree download

Almost half of ransomware-related threads included a blacklist of sectors, meaning the actors are not ready to buy access to companies from specific industries. 7% of ransomware attackers refused to buy access to companies from the health care and education industries. 37% prohibited compromising the government sector, and 26% claimed they would not purchase non-profit organizations access.

“When actors prohibit healthcare or non-profit industries offers, it is more likely due to the moral code of the actors. When the education sector is off the table, the reason is the same or the fact that education victims simply cannot afford to pay much,” she said.

“Finally, when actors refuse to target government companies, it is a precaution measure and an attempt to avoid unwanted attention from law enforcement.”

Unsurprisingly, Russian-speaking countries are off-limits for ransomware hackers, the research found.

“The actors based in CIS suppose that if they will not target these countries, local authorities will not hunt them,” she said.

Featured Resources

The 3D skills report

Add 3D skills to your creative toolkits and play a sizeable role in the digital future

Free Download

The increasing need for environmental intelligence solutions

How sustainability has become a major business priority and is continuing to grow in importance

Free Download

2022 State of the multi-cloud report

What are the biggest multi-cloud motivations for decision-makers, and what are the leading challenges

Free Download

Solve global challenges with machine learning

Tackling our word's hardest problems with ML

Free Download

Recommended

Accelerating healthcare transformation through patient-centred medtech solutions
Whitepaper

Accelerating healthcare transformation through patient-centred medtech solutions

20 Oct 2022
How to trust your inbox with Cloudflare Area 1
Whitepaper

How to trust your inbox with Cloudflare Area 1

19 Oct 2022
Best antivirus for Windows 10
antivirus

Best antivirus for Windows 10

13 Oct 2022
Ransomware now strikes one in 40 organisations per week, Check Point finds
ransomware

Ransomware now strikes one in 40 organisations per week, Check Point finds

27 Jul 2022

Most Popular

Yandex data breach reveals source code littered with racist language
data breaches

Yandex data breach reveals source code littered with racist language

30 Jan 2023
European partners expect growth this year, here are three ways they will achieve it
Sponsored

European partners expect growth this year, here are three ways they will achieve it

17 Jan 2023
Dutch hacker steals data from virtually entire population of Austria
data breaches

Dutch hacker steals data from virtually entire population of Austria

26 Jan 2023