Small businesses are being warned to prepare for a potential surge in ransomware attacks in 2022 as cyber criminals turn to campaigns that are less likely to draw coordinated action from law enforcement.
Cyber criminals are said to be adapting to increased pressure from police agencies that have launched a number of successful operations to dismantle criminal networks, according to an analysis by threat intelligence firm Analyst1, published today.
"Instead of going after the high-profile attacks, since the activity brings unwanted attention from the federal government, they will likely target smaller companies that will allow them to stay under the radar," said Chris Fiormonti, former intelligence community threat analyst and researcher with the company.
In a review of big-ticket ransomware activities for the year, Fiormonti noted increased scrutiny and efforts by western law enforcement to quash the more egregious groups.
This includes warnings from CISA and the FBI, including last month's advisories that ransomware attacks were likely to increase during the holiday season.
The US Treasury, which now treats ransomware with the same severity as terrorism, offered a $10m reward for information leading to the arrest of the BlackMatter group. Federal agencies also issued a joint alert that it had targeted critical infrastructure groups.
RELATED RESOURCE
Protecting every edge to make hackers’ jobs harder, not yours
How to support and secure hybrid architectures
Law enforcement has scored some significant wins, Fiormonti added, pointing to the disappearance of the BlackMatter group in November, and the disappearance of the REvil group in July, and again in October, following a multi-state effort. Europol also captured several REvil members last month.
Citing a paper by the company's chief security strategist, Fiormonti noted several direct links between ransomware groups and the Russian government, including the Business Club, Evilcorp, Silverfish, and Wizard Spider groups. While these groups primarily attack for profit, a change in targets from previous years fits Russian government targets, he said. A recent New York Times report said that some groups operate out of Moscow's Federation Tower East, a prestigious business address, with apparent impunity.
While the attacks might change direction, there is no sign that they will cease, Fiormonti added.
"Ransomware attacks will continue as long as they are profitable or until the core group of individuals that take safe haven in Russia are taken down or disrupted," he said.
-
The race is on for Higher Ed to adapt: Equity in hyflex learningHyflex courses can improve student wellbeing and engagement, but only with meeting technology that leaves no one behind
-
Gen Z workers are keen on AI in the workplace – but they’re still skeptical about the hypeNews Younger workers could lead the shift to AI, but only think it can can manage some tasks
-
Ransomware victims are getting better at haggling with hackersNews While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker groupNews An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabsNews An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs
-
UK SMBs are ramping up cybersecurity spending – and it’s about timeNews While small businesses are aiming to bolster their cyber defences, they're wary of AI
-
It's been a bad week for ransomware operatorsNews A host of ransomware strains have been neutralized, servers seized, and key players indicted
-
Everything we know about the Peter Green Chilled cyber attackNews A ransomware attack on the chilled food distributor highlights the supply chain risks within the retail sector
-
Scattered Spider: Who are the alleged hackers behind the M&S cyber attack?News The Scattered Spider group has been highly active in recent years
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reported
News Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
