The average ransom paid to hacking gangs after a ransomware attack is decreasing as more and more victim companies refuse to pay the ransoms demanded by cybercriminals. Specifically, an analysis by cybersecurity Coveware reports that the average ransom payment paid after a ransomware attack fell by a third in the last quarter of 2020 (from $233,817 to $154,108).
The company attributes the decrease in the average ransom payment to the fact that victims are choosing not to pay a ransom in bitcoin to receive a decryption key, which hackers claim will help them restore their network.
Although it is a positive fact that more and more victims choose not to pay ransoms, there remains a large number of organizations that give money to cybercriminals, allowing them to continue successfully their «operations», even if those behind the attacks have earned slightly less money.
Furthermore, Coveware pointed out in a blog post the following: “When fewer companies pay, regardless of the reason, it causes a long-term impact, which over time can make a difference in the volume of attacks.”
As ZDNet reports, the rise of organizations choosing not to succumb to ransomware extortion tactics has also led gangs to change their tactics, as evidenced by the rise in ransomware attacks where criminals threaten to leak stolen data if the victim doesn't pay. According to Coveware, these accounted for 70% of ransomware attacks in the last three months of 2020 – up from 50% in other months of the same year.
However, while almost three quarters of the organizations that received threats that their data would be leaked, in the period between July and September 2020, paid ransom, the percentage dropped to 60% for organizations that fell victim between October and December.
Security researchers note that even if ransoms are paid, there is no guarantee that the criminals will delete the data. On the contrary, they can use it for other malicious purposes, which organizations must consider before deciding whether to pay the ransom or not.
Furthermore, cybersecurity companies and agencies warn that any payment made after a ransomware attack encourages criminals to continue their attacks.
Ransomware continues to be successful because cybercriminals can successfully compromise unsecured networksin order to lay the foundation for attacks.
Phishing emails and exploiting the Remote Desktop Protocol (RDP) are the most common methods for ransomware to infiltrate networks. While a phishing email relies on victims opening malicious documents or links to initiate the attack, in the case of RDP, the victim does not need to participate at all because attackers can misuse leaked credentials . In both cases, ransomware finds a way to breach networks because cybercriminals exploit security vulnerabilities.
Applying security updates to prevent malicious attacks, in which hackers exploit known vulnerabilities, can go a long way in stopping malware on a network.
Furthermore, the use of tools such as two-factor authentication (2FA) can help prevent intruders from entering a network, because even if they have the correct login credentials in their hands, it is much harder for them to exploit them.
Finally, the regular updating of offline backups also provides organizations that fall victim to ransomware attacks with a means to restore their network, without empowering the hackers.
