Almost every ransomware attack now uses data exfiltration, or the unauthorized transfer of data from a device or network, which adds another layer of risk to organizations.

Theoretically, ransomware attacks continue to become more sophisticated because organizations are getting better at defending themselves. But modern attack methods are often able to bypass most of the basic protections that organizations have in place. 

Ransomware-as-a-Service (RaaS) lowers the barrier to entry even further, as cyberattackers no longer need to develop their own malware. Additionally, many ransomware attacks are still launched through phishing or spear phishing campaigns, and organizations that don’t put as much time and effort into training their employees tend to be easier targets. Some ransomware actors even launch secondary attacks to pressure organizations into paying. 

The chances of avoiding or preventing a sophisticated ransomware attack are difficult to calculate with precision, but assuming your organization will be targeted at some point can help begin the process of preparing for such an attack.

Ransomware attackers often use double extortion, first demanding payment from organizations to return their data or provide a decryption key, then demanding additional payment to destroy their copy of the data or threatening to publish it publicly. 

Ransomware is often successful and is becoming increasingly accessible to threat actors. But with a lower barrier to entry, most ransomware attacks today are less thoroughly researched than previously thought. Ransomware attackers are often given too much credit, when in reality their attacks may be akin to throwing spaghetti at the wall to see what sticks. While many threat actors plan ahead and hit organizations with deeper pockets, in all likelihood there are just as many that don’t. 

Calculating the cost of ransomware risks is often challenging due to nuances that make them unique compared to other types of cyberattacks. Not only are there threats of system outages or disruptions to business operations, but there are also threats of reputational or financial harm, not to mention the cost of litigation. 

Being prepared to respond to a successful ransomware attack could save your company time and money if an attack should occur. Understanding what’s at risk from a financial, operational, reputational and regulatory perspective may help you answer any questions about whether or not to pay.

Authorities often lack the resources to investigate or prosecute ransomware attackers. More often than not, ransomware actors launch attacks from countries where prosecution isn’t possible. While we may hear some examples of instances of threat actors being arrested and prosecuted, there is often politics at play in these unique situations. 

For the most part, ransomware actors correctly believe that they can attack organizations with impunity. It’s unlikely this will change in the near future.

There have been many attempts to quantify just how bad the ransomware problem really is, but there simply aren’t reliable statistics about ransomware out there. Oftentimes, the organizations that do pay don’t want it to be known that they’ve paid. 

It may be difficult to say with certainty that ransomware has become more successful without any empirical evidence to support that claim. But the frequency of attacks leads us to believe that they are often successful. 

Remember, most successful ransomware attacks never appear in the media and many may go unreported altogether. If the data we do have suggests the problem is bad, in all likelihood, it’s probably much worse. When successful ransomware attacks do make the news, try to imagine how your organization would respond in a similar situation. 

For an example, please see Conti cyber attack on the HSE.