The rise of ransomware: an end in sight?

The digital threat known as ransomware has become a headache for boardrooms. Once a niche cyberthreat, these malicious criminal programs are now crippling businesses large and small by encrypting vital data and demanding hefty ransoms for its return. Technology leaders warn of an AI-powered future where attackers will create ever more insidious encryption tools. Yet amid the digital chaos, there is still some optimism—provided businesses properly shore up their cyber defenses.

Whether businesses can weather the storm ultimately depends on their understanding of the dangers posed and, more importantly, the practical steps they can take to protect their digital assets from ransomware.

Jamie Moles

Senior Technical Manager at ExtraHop.

Recognizing the Ransomware Epidemic

The once marginal threat of ransomware has evolved into a sophisticated, multi-billion dollar criminal enterprise, estimated to exceed $1 billion in 2023. What began as a tactic deployed by opportunistic hackers has morphed into a global extortion racket, with organized cybercrime groups employing advanced encryption techniques and psychological manipulation tactics to cripple businesses and institutions.

This growing threat landscape presents a significant challenge for modern businesses, requiring a recalibration of cybersecurity strategies to address evolving digital shadow tactics.

Understanding the rise of RaaS

Ransomware-as-a-service (RaaS) has become a revolutionary tool in cybercrime. This insidious business model allows anyone, regardless of technical expertise, to become a ransomware attacker.

Imagine for a moment “Deliveroo for malware.” Developers create and maintain the malware, while affiliates simply rent access and leverage the tools to launch attacks. RaaS marketplaces provide a one-stop shop for aspiring cybercriminals, offering everything from customer support to malware updates. This low barrier to entry has fueled a rise in ransomware attacks.

One of the most high-profile cases of RaaS in history was the DarkSide attack on Colonial Pipeline in 2021. The attack left hundreds of Americans facing gas and supply shortages after Colonial Pipeline, the owner of a pipeline system that transports fuel from Texas to the Southeast, suffered a ransomware attack on its IT systems. Colonial Pipeline ended up paying a whopping $4.4 million ransom, leaving the company struggling to restore its operations.

Learn from the LockBit case

The rise of ransomware is exemplified by the LockBit attack, a particularly virulent strain that rose to prominence in 2019 and accounted for nearly half of all ransomware attacks in 2022. The malware uses a “double extortion” tactic, encrypting vital data and threatening to leak it online if ransom demands are not met.

As a RaaS, LockBit has enabled a network of criminals to target a wide range of victims, from large enterprises to critical infrastructure providers. LockBit’s operators have gone so far as to offer a $1 million reward to security researchers and hackers, ethical or otherwise, who can improve the security of its software. Its ruthless effectiveness and adaptability have highlighted the growing dangers posed by ransomware.

LockBit’s success is a wake-up call for the cybersecurity industry. Traditionally focused on perimeter defenses, the industry must adapt to this new reality of aggressive and adaptable attackers. This requires a multi-pronged approach.

On one hand, cybersecurity companies must develop more sophisticated detection and prevention tools to stay ahead of the curve. On the other, a cultural shift is needed, prioritizing employee training and incident response planning. Ultimately, the cybersecurity industry’s ability to mitigate the growing ransomware tide will depend on its ability to innovate and foster a more proactive security posture.

Prevent employees from welcoming bad guys

For many organizations, the digital perimeter resembles a crumbling Cold War watchtower, poorly maintained and understaffed. Legacy systems, riddled with unaddressed vulnerabilities, provide easy access for attackers.

Weak authentication protocols are easy entry points for stolen credentials. The human factor is perhaps the most concerning. Untrained employees remain vulnerable to phishing scams, unknowingly downloading ransomware with a single click. These gaps paint a bleak picture for many businesses.

Even so, there is a solution. Companies can solidify their employees’ cybersecurity knowledge by implementing regular training that combines core awareness topics with role-specific best practices. These trainings should be engaging and updated frequently to reflect the evolving threat landscape. Leaders can cultivate a culture of security by serving as role models and encouraging open communication about cyber risks. Periodic refreshers and testing can also reinforce employees’ understanding and ensure they maintain essential cybersecurity practices.

Accelerate defense awareness and action

A key solution to protecting businesses from ransomware attacks is network detection and response, or NDR. NDR systems are the digital equivalent of a well-trained watchdog. These monitoring tools continuously scan network traffic, detecting anomalies that could signal a ransomware attack in progress.

Unlike its canine counterpart, NDR operates with millisecond accuracy, identifying suspicious activity—unusual data exfiltration attempts or unauthorized access attempts—in real time. This rapid detection allows security teams to act quickly, potentially eradicating the ransomware threat before it can encrypt an organization’s data.

NDR systems can also recognize telltale signs of ransomware encryption, helping to quickly isolate infected devices and prevent the spread of contagion across the network. In the growing war against ransomware, NDR is a crucial line of defense, providing a multi-layered approach: identifying suspicious activity, facilitating rapid response, and containing the threat before it wreaks havoc.

Making RaaS a bygone threat

The future of ransomware could be bleak for businesses that hackers are interested in, with the specter of AI-powered attacks looming. However, that doesn’t mean surrender. By acknowledging the threat, prioritizing cybersecurity investments, and fostering a culture of security awareness within organizations, businesses can strengthen their digital defenses.

We have listed the best identity management software.

This article was written as part of TechRadarPro’s Expert Insights channel, where we showcase the best and brightest minds in today’s tech industry. The opinions expressed here are those of the author and not necessarily those of TechRadarPro or Future plc. If you’d like to contribute, find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro