Ransomware gangs are now demanding money from victims' customers. Experts are warning of a new tactic by ransomware gangs, which involves triple extortion. Until now, we knew about double extortion. The attackers encrypted the victims' systems and demanded a ransom for decryption. But to put pressure on them and get more money, they threatened to leak data they had stolen from the systems. Now, hackers are not only blackmailing the victim for ransom, but are also demanding money from customers or partners affected by the initial breach.
Check Point 's latest ransomware report showed that over the past year, ransomware payments increased by 171%, and that globally the number of attacks increased by 102%.
The company's researchers said that attackers are still looking for methods to increase the chances of receiving the ransom and generally making more money.
See also: The DarkSide ransomware gang ends its "operation"!
Researchers said the first triple-extortion ransomware attack was observed last October, when a Finnish psychotherapy clinic was compromised. The clinic paid the ransom, but the attackers also demanded money from patients, threatening to release data related to their treatment.
Also in February, the REVIL ransomware gang began combining its attacks with DDoS attacks and notified victims’ associates about the attack. In addition, the hackers called journalists and informed them about their attacks, in order to put more pressure on the victims.
See also: AXA insurance: Ransomware targeted Asian branches
“Third-party victims, such as the victim company’s customers, external partners and service providers, are largely impacted by data breaches caused by these ransomware attacks, even if their network resources are not directly targeted,” Check Point said. “Whether further ransom is demanded from them or not, they are powerless against such a threat and have a lot to lose.”
Triple Extortion Ransomware: What are the main targets?
utilities Healthcare organizations are most likely to be attacked by ransomware groups. This sector experiences 109 attack attempts per week. It is followed by and the legal and insurance sectors .
In terms of location, organizations in Asia-Pacific face the most attacks, according to Check Point, but since the beginning of 2021, Africa has seen the largest increase in attacks compared to the previous year.
See also: QNAP warns of eCh0raix ransomware attacks
However, there is no country or organization that is completely unaffected by ransomware attacks.
Large companies around the world are falling victim to ransomware attacks and facing problems even after paying the ransom.
Check Point advises organizations to be constantly on the alert and monitor their systems at all times.
“Most ransomware attacks in the last year took place on weekends and during holidays, when system monitoring is more relaxed,” the report said.
Check Point also recommends:
- Regular system updates to fix vulnerabilities
- Staff training to identify suspicious and dangerous emails, messages, etc
- Continuous monitoring for infections related to Trickbot, Emotet, Dridex, and CobaltSrike.
Source: Threatpost
