Cyber-Zombie Apocalypse: Ransomware Gangs Continue to Come Back from the Dead
With ransomware gangs making so much money and then dropping off the face of the earth, what’s the motivation to come back to life and potentially risk getting caught?
We saw REvil come back from the shadows and hit a Fortune 500 company last month. Similarly, we saw BlackByte do the same thing brandishing a new extortion strategy. And then there’s the ransomware-as-a-service groups like Conti who have been shut down – leaving us wondering if (and, more likely, when) they will spring up as a new ransomware variant.
If they’re making so much money – as the total ransomware take is estimated by Cybersecurity Ventures to be over $20 billion last year – why shut down and, more importantly, why bother coming back?
There are a few reasons why ransomware gangs continue to come back from the dead:
- They want to change their stripes – we saw the government specifically crack down on REvil last year, even offering a reward for information leading to their capture. This kind of pressure from authorities is enough for a gang to want to run and hide… that is, until they recode their wares and rebrand themselves as a new gang.
- They join a cartel or change their business model – some of the recent ransomware cartels have formed to share techniques, code, and infrastructure. Others switch from a business model where they gang themselves develops the ransomware code and performs the attacks to an affiliate model to offset the risk of being the threat actors specifically targeted by authorities.
- There’s plenty of money in it – in addition to Cybersecurity Ventures predicting 2021 ransomware costs, they also project that ransomware will cost $265 billion by 2031. So, if you’re really good at ransomware, you may not want to stop, as there may be more money left on the proverbial ransomware table to be taken.
No matter the reason, we should assume that in cases other than when the gangs are arrested and put behind bars, like any other industry where someone has experience and skills, those responsible for ransomware will continue to spawn up with a new version in an attempt to make as much money before then have to hide… and do it again.
Free Ransomware Simulator Tool
Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?
KnowBe4’s “RanSim” gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.
Here’s how it works:
- 100% harmless simulation of real ransomware and cryptomining infections
- Does not use any of your own files
- Tests 23 types of infection scenarios
- Just download the install and run it
- Results in a few minutes!
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/ransomware-simulator-tool-partner?partnerid=001a000001lWEoJAAW