Ransomware Hackers Look for New Tactics Amid Falling Profits

Waning profitability of ransomware for cybercriminals is having the unintended side effect of making digital extortionists try out aggressive new shakedown methods, including bribery and lies.

See Also: Preparing for the Next Attack

“Increasingly dire economics are forcing ransomware actors to be less opportunistic and more creative and targeted when choosing their victims,” says a report from data protection and backup firm Veeam’s Coveware unit.

Coveware data shows the number of victims who paid a ransom for any reason during the third quarter dropped below one-quarter for the first time in ransomware history. When a victim did choose to pay, they paid less: on average $376,941, or a median payment of $140,000, both of which represented a two-thirds decline in value from the second quarter.

A large part of that decline is due to skepticism by larger enterprises over hackers’ promises of deleting stolen data. Ransoms paid in response to an attack that only involved data exfiltration fell to just 19% in the third quarter.

Faced with diminishing returns and the decision of some large players to quit the field, the ransomware ecosystem has significantly fragmented, experts say. “The number of unique data-leak sites hit an all-time high of 81 in Q3, as smaller ransomware groups have filled the gaps left by larger ones,” said cybersecurity firm ReliaQuest. “This fragmentation has led to unpredictable attack patterns, affecting sectors and regions not traditionally targeted, such as Thailand.”

Some operations – including Russian-speaking Akira and Qilin – have focused on targeting midsize organizations, which “cannot afford large ransoms but remain easier to disrupt,” Coveware said.

Other recent strategies for boosting profits have included an increase in attempts to recruit or bribe insiders, socially engineer help desks, launch supply chain attacks and Callback phishing.

Pioneered by the Ryuk ransomware group in 2021, callback phishing involves breaking down victims’ defenses by spurring them into calling the scammers themselves, allowing attackers to engage in real-time negotiation. “The live interaction during a phone call enables attackers to manipulate the victim’s emotions and responses by employing social engineering tactics,” said Cisco Talos in a July report.

The Silent Ransom group in particular employs this strategy, “targeting firms narrowly in the insurance and law firm verticals” as it attempts to steal their data and hold it to ransom, Coveware said.

Ransomware hackers are also resorting to bribing insiders, especially employees of “large-scale, high-value targets,” aka “white whales,” who have deep pockets but are otherwise tough for attackers to breach, Coveware said. Accordingly, “enterprises should re-evaluate the maturity of their insider threat programs – both for mitigations of unauthorized data theft and, apparently, even the staging and execution of full-fledged ransomware attacks,” it said.

Anecdotal evidence of ransomware groups attempting to cultivate insiders not just to steal data but also to help unleash ransomware abounds. The Western collective Scattered Lapsus$ Hunters, formed from elements of Scattered Spider and Shiny Hunters, earlier this month posted on one of its darknet sites an advertisement for insiders at large Australian firms who want to work with it.

A BBC reporter detailed an attempt by the Medusa ransomware-as-a-service operation to recruit him. The group’s “reach out manager” promised: “We aren’t sure how much the BBC pays you but what if you took 25% of the final negotiation as we extract 1% of the BBC’s total revenue? You wouldn’t need to work ever again.”

On its Telegram channels, for its Salesloft campaign, Scattered Lapsus$ Hunters likewise tried to recruit “other threat actors to help send extortion notes to victims via email, specifically focusing on communicating with executives” said Palo Alto Networks’ Unit 42 threat intelligence group.

Ransomware group members are testing other shakedown strategies too. In its recent data-stealing campaign targeting Oracle E-Business Suite users, the Clop extortion group sent ransom emails to executives at multiple organizations, in one case demanding a $50 million ransom payment.

“The emails were sent from compromised business email accounts or newly registered accounts but contained authentic contact points with ransomware operators,” as published on Clop’s data-leak site, said threat intelligence firm Resecurity.