Ransomware attacks continue to be the biggest existential cyber threat for companies, with about 59 per cent of organisations hit by ransomware last year and about 66 per cent reporting in both the previous two years. Additionally, approximately 96 per cent of Indian organisations that were hit by ransomware over the past year engaged with law enforcement and/or official government bodies for help with the attack, a report by Sophos said.
The chances to be hit by ransomware generally increase with revenue, with USD 5 billion-plus organisations reporting the joint highest rate of attack (67 per cent).
However, even the smallest organisations (less than USD 10 million revenue) are still regularly targeted, with just under half (47 per cent) hit by ransomware in the last year, said the report.
While many ransomware attacks are executed by sophisticated, well-funded gangs, the use of crude, cheap ransomware by lower-skilled threat actors is on the rise.
Exploited Vulnerabilities- The Root Cause
Approximately 99 per cent of organisations hit by ransomware were able to identify the root cause of the attack, with exploited vulnerabilities the most commonly identified starting point for the second year running, highlighted the report.
Overall, the running order remained consistent and email-based approaches were identified as the root cause of attack by 34 per cent of respondents, with around twice as many starting with a malicious email (i.e., a message with a malicious link or attachment that downloads malware) as phishing (i.e., a message designed to trick readers into revealing information).
Phishing is typically used to steal log-in details and as such can be considered the first step in a compromised credentials attack.
While all ransomware attacks have negative outcomes, some are more devastating than others.
Organisations whose attacks began with exploitation of an unpatched vulnerability report considerably more severe outcomes than those where attack started with compromised credentials, including a higher propensity to have backups compromised, have data encrypted, pay the ransom and cover the full cost of ransom in-house, said the report.
High Data Encryption & Theft
Seven in ten (70 per cent) ransomware attacks in the last year resulted in data encryption. While high, this rate represents a small drop from the 76 per cent of attacks where adversaries succeeded in encrypting data that was reported in 2023, according to the report.
While state/local government reported the lowest frequency of attack this year (34 per cent hit by ransomware), it also reported the highest rate of data encryption, with 98 per cent of attacks resulting in data being encrypted.
Financial services (49 per cent) followed by retail (56 per cent) reported the lowest rates of data encryption, it added.
Adversaries don’t just encrypt data, they also steal it. In 32 per cent of incidents where data was encrypted, data was also stolen – slightly above last year’s rate of 30 per cent, said the report.
Data theft increases attackers’ ability to extort money from their victims, while also enabling them to further monetise the attack by selling the stolen data on the dark web, it said.
