{"id":60745,"date":"2021-05-17T15:26:58","date_gmt":"2021-05-17T14:26:58","guid":{"rendered":"https:\/\/www.intelligentcio.com\/me\/2021\/05\/17\/kaspersky-sheds-light-on-the-ransomware-ecosystem\/"},"modified":"2021-05-20T09:34:57","modified_gmt":"2021-05-20T08:34:57","slug":"kaspersky-sheds-light-on-the-ransomware-ecosystem","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/me\/2021\/05\/17\/kaspersky-sheds-light-on-the-ransomware-ecosystem\/","title":{"rendered":"Kaspersky sheds light on the ransomware ecosystem"},"content":{"rendered":"\n

Ransomware is on the tip of everyone\u2019s tongue every time businesses discuss cyberthreats they are likely to face in 2021. Attackers have built their brands and are bold in their advances like never before, with the news about organisations being hit with ransomware consistently on newspaper front pages. But by placing themselves under the spotlight, such groups hide the actual complexity of the ransomware ecosystem. To help organisations understand how the ransomware ecosystem operates and how to fight it, the latest report<\/a> by Kaspersky researchers dug into darknet forums, took a deep look at REvil and Babuk gangs, and beyond to debunk some of the myths about ransomware. And when you dig into this underworld, you have to expect that it has many faces.<\/p>\n\n\n\n

Like any industry, the ransomware ecosystem comprises of many players that take on various roles. Contrary to popular belief that ransomware gangs are actually tight, they have been through it all together, Godfather-style groups, the reality is more akin to the world of Guy Ritchie\u2019s \u2018The Gentlemen\u2019, with a significant number of different actors \u2013 developers, botmasters, access sellers, ransomware operators \u2013 involved in most attacks, supplying services to each other through dark web marketplaces.<\/p>\n\n\n\n

These actors meet on specialised darknet forums<\/a> where one can find regularly updated ads offering services and partnerships. Prominent big-game players that operate on their own do not frequent such sites, however, well-known groups such as REvil that have increasingly targeted organisations in the past few quarters, publicise their offers and news on a regular basis using affiliate programmes. This type of involvement presumes a partnership between the ransomware group operator and the affiliate with the ransomware operator taking a profit share ranging from 20 to 40%, while the remaining 60 to 80% stays with the affiliate.<\/p>\n\n\n\n

Selection of such partners is a finely-tuned process with ground rules set by the ransomware operators from the start \u2013 including geographical restrictions and even political views. At the same time, ransomware victims are selected opportunistically.<\/p>\n\n\n\n

As the people who infect organisations and the ones who actually operate ransomware are different groups, only formed by the desire to profit, the organisations infected most are often low hanging fruit \u2013 essentially, the ones that the attackers were able to gain easier access to. It could be both actors that work within the affiliate programmes and independent operators that later sell access \u2013 in an auction form or as a fix, starting as low as US$50. These attackers, more often than not, are botnet owners who work on massive and wide-reaching campaigns and sell access to the victim machines in bulk and access sellers on the lookout for publicly disclosed vulnerabilities in Internet facing software, such as VPN appliances or email gateways, which they can use to infiltrate organisations.<\/p>\n\n\n\n

Ransomware forums are home to other types of offers too. Some ransomware operators sell malware samples and ransomware builders for anything from US$300 to US$4,000, while others offer Ransomware-as-a-Service \u2013 the sale of ransomware with continued support from its developers, which can range from US$120 per month to US$1,900 per year packages.<\/p>\n\n\n\n

Dmitry Galov, Security Researcher, Kaspersky\u2019s Global Research and Analysis Team, said: \u201cThe ransomware ecosystem is a complex one with many interests at stake. It is a fluid market with many players, some quite opportunistic, some \u2013 very professional and advanced. They do not pick specific targets, they may go after any organisation \u2013 an enterprise or a small business, as long as they can gain access to them. Moreover, their business is flourishing, it is not going away anytime soon. The good news is that even rather simple security measures can drive the attackers away from organisations, so standard practices such as regular software updates and isolated backups do help and there is much more that organisations can do to secure themselves.\u201d<\/p>\n\n\n\n

Ivan Kwiatkowski, Senior Security Researcher, Kaspersky\u2019s Global Research and Analysis Team, said “Effective actions against the ransomware ecosystem can only be decided once its underpinnings are truly understood. With this report, we hope to shine a light on the way ransomware attacks are truly organised, so that the community can set up adequate countermeasures.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"

Ransomware is on the tip of everyone\u2019s tongue every time businesses discuss cyberthreats they are likely to face in 2021. Attackers have built their brands and are bold in their advances like never before, with the news about organisations being hit with ransomware consistently on newspaper front pages. But by placing themselves under the spotlight, […]<\/p>\n","protected":false},"author":18,"featured_media":58174,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5307,5,36,54,13],"tags":[2158,364,4919,13516],"class_list":["post-60745","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analysis","category-enterprise-security","category-intelligent-technology","category-research","category-top-stories","tag-cyberthreats","tag-kaspersky","tag-ransomware-as-a-service","tag-revil"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/60745","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/users\/18"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/comments?post=60745"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/60745\/revisions"}],"predecessor-version":[{"id":60860,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/60745\/revisions\/60860"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media\/58174"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media?parent=60745"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/categories?post=60745"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/tags?post=60745"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}