2024 Ransomware: New Tactics, New Techniques, New Trends

The continuous growth of ransomware in recent years has made it a persistent hot topic on the annual security threat list. The most noteworthy ransomware incident in 2023 involved the "world's largest bank" being hit by LockBit ransomware and paying a ransom. This resulted in US$9 billion in unsettled transaction arrears and disrupted the liquidity of the US$26 trillion US Treasury market.

As a result, 2024 remains a highly challenging year, especially for the financial system. Since the high-profile attack on Bank X, major global banks have raced to enhance their security defense capabilities.

In recent years, the primary techniques used by ransomware have evolved, and their volume has fluctuated alongside market shifts. Criminals continuously refine their extortion methods to improve effectiveness. Looking at the trend of this evolution, criminals are gradually moving away from encryption techniques and instead focusing on refining their extortion methods. This evolution is primarily driven by three factors: geopolitical influences, the professionalization of criminals, and the attitudes of governments and law enforcement agencies in responding to threats.

01

—

Geopolitics Triggering Cyber Warfare Crises:

Data Wiping Extortion Rising in Popularity, Ransomware Groups Splitting and Regenerating

For years, geopolitically related cyber underground warfare has been occurring globally. As the Russia-Ukraine war heats up, cyber warfare has also become more intense and apparent. Criminal syndicates have beaten national states to the punch, launching public attacks on their adversaries' critical infrastructure.

Some experts note, "The growth rate of ransomware attacks appears to have slowed slightly, but that is a false signal." Currently, the world's most powerful cybercriminal teams are focusing their attacks on Ukraine's critical infrastructure. Once the conflict ends, it is clear that all technologies, tools, and resources will be rapidly redeployed to ransomware attacks.

One of the negative consequences of the Russia-Ukraine war includes the increasingly destructive nature of ransomware. Massively increased ransomware attacks are targeting all industries. Attackers constantly attempt to stay ahead of vendors by developing new tactics, techniques, and procedures (TTPs), riding the wave of data wiping to drive a mounting wave of attacks.

Criminals adopt this technique for two reasons: First, the disruption of Ukrainian critical infrastructure has caused a ripple effect of related cyber destruction, providing a natural opportunity for syndicates to adopt data-wiping extortion. Second, since it is all about extortion, criminals tend to adopt more effective extortion methods, of which data-wiping extortion is one.

Data wiping is faster than encryption and much easier to code. It does not require complex public-private key processing, nor does it require providing complex decryption code to recover losses after the victim pays the ransom. If data is destroyed and the business has no backup, the only options are to pay or lose the data. Furthermore, law enforcement's investigative capabilities are growing stronger. The more damage syndicates cause after stealing data, the harder it is for their own tracks to be traced.

In addition, the volatile geopolitical situation brings other threats. Statistically, a large-scale, deep-impact cyber virus epidemic occurs every six to seven years. The infamous WannaCry ransomware worm utilized the EternalBlue vulnerability to propagate automatically to vulnerable machines. If ransomware criminal organizations discover a vulnerability with extremely high coverage, the probability of such an event is very high. The current global tensions greatly increase the likelihood of ShadowBrokers-style hacking leak incidents.

The current geopolitical situation could also lead to an unexpected issue: the fragmentation and regeneration of ransomware groups. Many large organizations are multinational, with different members having different geopolitical allegiances. Several large ransomware syndicates have shut down over the past few years, including Conti, the largest among them. After the outbreak of the Russia-Ukraine war, Conti's leadership backed Russia politically, sparking internal disputes. Ukrainian members broke away from Conti and leaked internal documents, forcing Conti to shut down and rebrand.

However, although old organizations have collapsed, new ones continue to emerge. As leadership and affiliates establish their own ventures, retire, or switch allegiances, Conti's collapse and Darkside's rebranding prove that a facelift is highly effective for shaking off unwanted attention. Driven by profit, if this trend continues, the number of "newborn" ransomware groups will increase dramatically.

02

—

Refinement of Ransomware Capabilities: RaaS and Policy Adjustments Moving in Parallel

▌ Rise of Elite Criminal Syndicates: Commercialization of the Ransomware Industry

What began as small-scale operations has evolved over the years into syndicates with operational efficiencies surpassing those of many Fortune 500 companies. Elite criminal syndicates develop malware and lease it to third-party companies for a fee, securing massive profits while reducing personal risk. This success will drive more syndicates down the same path.

However, non-tier-one ransomware groups and paying affiliates of RaaS may struggle in their battles with law enforcement. Like a game of whack-a-mole, RaaS groups will surface, launch attacks, disappear after being taken down by law enforcement, and plot to resurface in the future. Internal instability within criminal organizations is also a key factor causing different groups to rise and fall in succession.

▌ Evolution of Ransomware Attacks: Rise of New Tactics, Smaller Targets, and Stealthier Techniques

As defenses against ransomware grow stronger, attackers constantly alter their tactics. Many attackers choose simpler, peripheral pathways to acquire the same critical data. An increasing number of ransomware actors utilize proven methods to evade law enforcement, growing their business by exploiting critical vulnerabilities in common applications (such as Microsoft Exchange, firewalls, and other widely used software).

The focus of ransomware attacks will shift to smaller, less-defended institutions. On one hand, larger organizations have stronger defenses; on the other hand, easily operated ransomware continues to emerge.

In the future, the scale of ransomware attacks will be smaller with lower ransom demands, but the target audience will be broader. Furthermore, professionalized attackers will adopt new attack techniques. Some attackers can combine physical and cyber intrusion, using drones for close-range hacking. For example, they mount numerous tools on drones to collect WPA handshakes for cracking Wi-Fi passwords offline, or even drop malicious USB drives in restricted areas, waiting for passersby to pick them up and plug them into computers.

Experts believe that ransomware syndicates will increasingly target cloud objectives. As the use of and reliance on cloud technology continues to surge, third-party supply chains provide more hiding spots for those with criminal intent. Targeting cloud providers yields significant rewards for attackers. The continuous emergence of technologies that evade typical security stacks, such as HEAT (Highly Evasive Adaptive Threats) attacks, can not only bypass traditional enterprise security measures but also lure employees into their traps.

The persistence of ransomware will also increase. Criminals have begun exploiting stealthier techniques to generate revenue. Cybercriminal organizations like Elephant Beetle have demonstrated that criminals can lurk in an enterprise's critical business applications undetected for months or even years, quietly siphoning off tens of millions of dollars.

A threat group could lurk within a Fortune 500 company's network for months or even years, quietly stealing emails and accessing critical data. These companies only discover their data has been compromised when the criminal group threatens to leak sensitive information on the dark web.

03

—

Economic Downturn Adding Fuel to the Fire, Ransomware Threats Growing with the Trend

In addition to the growing sophistication of existing criminal groups, there is another threat to watch: the worsening global economic situation.

First, as businesses cut costs, a large number of IT professionals are being laid off. More originally law-abiding individuals may be tempted by RaaS. This factor alone could lead to more ransomware attacks launched by new potential criminals.

Second, companies will reduce headcount and cut security budgets due to economic conditions. For executives, cybersecurity spending may be viewed as an extra expense rather than an essential cost for maintaining the business. These companies will reduce budgets for cybersecurity tools or talent to cut costs, but this actually lowers the company's capability to detect and prevent data breaches, allowing crises to grow unnoticed.

Moreover, relying solely on law enforcement is insufficient; a powerful crackdown on ransomware organizations at the government level is necessary. While law enforcement can dismantle criminal infrastructure, criminal syndicates will simply migrate to new infrastructure to continue their crimes. The only way to stop extortion is to disrupt the profitability. If criminals cannot make a profit, they will stop and try other methods, but this is highly difficult. As ransomware becomes more destructive, whether to pay the ransom becomes a major dilemma. If a company refuses to meet the criminals' demands, putting victims of stolen PII (Personally Identifiable Information) at unknown risk, any department prohibiting ransom payments will become a target of public criticism.

04

—

Summary: Proactive Defense Against Ransomware Is All About Gaining the Upper Hand

Ultimately, defeating ransomware depends mostly on a company's own cyber defense capabilities. Yet, even the most well-defended companies can find it difficult to guarantee 100% resistance to penetration by ransomware syndicates.

Therefore, we typically advise enterprises to initiate proactive defenses as early as possible. The goal of proactive defense is to seize the initiative.

On one hand, enterprises must race against time with attackers, preparing defenses as much as possible before becoming targets, and validating whether they can withstand the most popular or latest attack methods.

On the other hand, it is a race against other companies that might be attacked. Being the first to conduct security effectiveness validation allows a company to reach safety first amidst the pervasive onslaught of extortion syndicates.

Under the current highly intense security climate, enterprises must be targeted when enhancing their security defenses, refining and strengthening their weak points. Starting from the attacker's perspective, SecurityGen validates enterprise defense capabilities with real attack methods to precisely locate security defense shortcomings. Users can filter ransomware-related attack techniques on the SecurityGen security validation platform to verify if they can defend against them.

It is especially important to note that even seemingly minor defense failure points must be discovered and remediated in a timely manner. A sluggish response is equivalent to giving attackers a green light, making the enterprise a much easier target for repeated attacks by criminal groups.