Ransomware suffers a year-on-year increase of 14%

Check Point details how ransomware has evolved in recent years, from WannaCry authors demanding just a few hundred dollars from their victims to Conti asking for tens of millions. Check Point Software also reveals a 14% year-over-year increase in ransomware attacks globally and states that organizations must prioritize prevention if they want to combat this growing threat.

In 2017, WannaCry was the first of its kind: a global, state-sponsored, multi-vector attack. Despite this, the initial extortion demand was only $300. Although WannaCry was not a pioneer in terms of profitability, it was pioneer in terms of ushering in the political use of ransomware. In the past five years, their operations have grown from random emails to multi-million dollar businesses such as NotPetya, REvil, Conti and DarkSide, carrying out targeted and sophisticated attacks affecting companies across all industries. The ransom demand Kaseya faced in 2021 was reportedly $70 million.

The rise of double and triple extortion

Remote and hybrid work modalities, coupled with accelerating cloud adoption, have opened up new opportunities for attackers to exploit. Its sophistication is increasing, with new trends such as Ransomware-as-a-Service or double and even triple extortion. Cybercriminals threaten to publish private information for double extortion and demand ransom not only from the infected organization itself, but also from its customers, partners, and suppliers in the triple extortion format.

Attacks on governments and critical infrastructure

A few days ago there were two incidences of this attack in Costa Rica and Peru, both allegedly carried out by the infamous Conti ransomware group. Both threats led the Costa Rican government to declare a state of emergency on May 6 and estimate losses of 200 million dollars by paralyzing customs and government agencies, and even caused the loss of electricity in one of its cities due to the impact of a major energy supplier. In recent years, another of the most notorious attacks on critical infrastructures was the one that affected Colonial Pipeline.

A few days ago there were two ransomware incidents in Costa Rica and Peru, both allegedly executed by the infamous Conti ransomware group

All companies are targeted

While governments and large corporations often grab the headlines, ransomware actors are indiscriminate, targeting businesses of all sizes and industries. To protect themselves, IT teams must prioritize prevention. They need to be on the lookout for any signs of Trojans on their networks, regularly update their antivirus software, proactively patch relevant RDP (Remote Desktop Protocol) vulnerabilities, and use two-factor authentication.

In addition, companies must deploy targeted anti-ransomware solutions that constantly monitor their own behaviors and identify illegitimate file encryption, so that an infection can be prevented and quarantined before it takes hold. With these protections, businesses can be better prepared when they are attacked, because in the current climate it is a question of when, not if…