Ransomware “presents the most immediate danger to the UK”, according to the head of the National Cyber Security Centre (NCSC).
NCSC CEO Lindy Cameron issued the warning as part of her speech during Monday’s Cyber 2021 conference at Chatham House.
Reflecting on her first year as NCSC CEO, Cameron said that the body has witnessed “real-world impact from a spate of ransomware attacks” which had caused “significant damage (...) to the public sector”.
The ransomware attacks on Ireland’s Health Service Executive (HSE) and London’s Hackney Borough Council were among the examples listed by Cameron, who also mentioned US incidents targeting SolarWinds and Colonial Pipeline.
Despite the rise in attacks, many UK organisations “have no incident response plans, or ever test their cyber defences,” she added.
The speech comes days after a report found that only a third (35.8%) of businesses have insurance cover for ransomware attacks, despite it being one of the most common forms of cyber threat. Almost one in six (15.9%) of respondents also reported having no disaster recovery plan in place, making them unprepared to deal with a potential attack.
Cameron also advised organisations to not succumb to hackers’ financial demands, saying that the NCSC expects ransomware to “continue to be an attractive route for criminals as long as organisations remain vulnerable and continue to pay”.
RELATED RESOURCE
The best defence against ransomware
How ransomware is evolving and how to defend against it
“We have been clear that paying ransoms emboldens these criminal groups – and it also does not guarantee your data will be returned intact, or indeed returned at all,” she added.
Russia was named the culprit of the UK’s ransomware woes, with the NCSC and the National Crime Agency (NCA) finding that “cyber criminals based in Russia and neighbouring countries are responsible for most of the devastating ransomware attacks against UK targets”.
China, North Korea, and Iran were also found to be threats to the UK’s cyber security – Cameron said that, although the latter two states are “less sophisticated than Russia and China”, they “regularly use digital intrusions to achieve their objectives – including through theft and sabotage”.
Russia had been found to be behind last year’s attack on SolarWinds, with US and UK security agencies also publishing a joint advisory warning against a ‘global brute force campaign’ orchestrated by the Russian government.
-
Kids hacking for kicks are causing security headaches at schoolsNews More than half of cyber incidents at schools are caused by students, with some tech-savvy pupils attempting to bypass security and network controls.
-
Kaseya targets new growth with double C-suite appointmentNews Anthony Anzevino joins the security vendor as chief revenue officer, while Pratik Wadher takes the role of chief technology officer
-
Prolific ransomware operator added to Europe’s Most Wanted list as US dangles $10 million rewardNews The US Department of Justice is offering a reward of up to $10 million for information leading to the arrest of Volodymyr Viktorovych Tymoshchuk, an alleged ransomware criminal.
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attackNews The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalitiesNews The attack on IT systems supplier Miljödata has impacted public sector services across the country
-
A notorious hacker group is ramping up cloud-based ransomware attacksNews The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b modelNews Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
