IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Ransomware gangs shift focus to big businesses

Research shows that criminals are going after more banks and corporations

Ransomware gangs are starting to shift their focus from wide-ranging campaigns to targeted attacks on large companies and banks, according to new research.

Rather than simply attempting to spread their ransomware to as many users as possible, Kaspersky Lab's annual ransomware report has revealed that cyber criminals are making a concerted effort to target big businesses.

The security firm has identified eight separate criminal groups that are targeting financial institutions and major corporations, including the Mamba group. These gangs pick their targets carefully, identify business-critical resources and wait patiently while the malware spreads, with some samples proliferating through an organisation for up to six months.

"The reason for the trend is clear," the report said; "criminals consider targeted ransomware attacks against businesses potentially more profitable than mass attacks against private users."

This tactic evidently had some merit - Kaspersky observed cases where criminals were asking for $1,000 in Bitcoin to decrypt each individual endpoint, as well as cases where the total ransomware demands for a company's infection came to over half a million dollars.

Another emerging trend the report highlighted was cyber criminals stealing each others' work. Despite the creators of the Petya ransomware building in anti-theft measures designed to prevent other hackers using it for their own ends without permission, a new strain was discovered to be doing just that.

The PetrWrap ransomware, which was discovered in March of this year, uses the Petya encryption algorithm to lock its victims files - but uses its own decryption keys, meaning that the gang behind it don't need the original authors to decrypt the files after the ransom is paid. Researchers are taking this as evidence that increased competition in the ransomware space is causing some criminals to start fighting amongst themselves for market share.

"Theoretically, this is good, because the more time criminal actors spend on fighting and fooling each other, the less organised and effective their malicious campaigns will be," the report said.

"The worrying thing here is the fact that PetrWrap is used in targeted attacks. This is not the first case of targeted ransomware attacks and unfortunately is unlikely to be the last."

Ilia Kolochenko, CEO of web security firm High-Tech Bridge, agreed that cyber crime gangs are starting to wise up and pursue more profitable targets. "The report is a clear indicator that the ransomware market is becoming more professional and mature," he said. "Actors are working on various niche specialisations to avoid direct competition and maximise their profit."

Featured Resources

Meeting the future of education with confidence

How the switch to digital learning has created an opportunity to meet the needs of every student, always

Free Download

The Total Economic Impact™ of IBM Cloud Pak® for Watson AIOps with Instana

Cost savings and business benefits

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

Technology reimagined

Why PCaaS is perfect for modern schools

Free Download

Recommended

CMO job description: What does a chief marketing officer do?
Business strategy

CMO job description: What does a chief marketing officer do?

9 Jun 2022
CFO job description: What does a chief financial officer do?
Business strategy

CFO job description: What does a chief financial officer do?

9 Jun 2022
What does a CISO do?
Careers & training

What does a CISO do?

12 May 2022
Business value on AWS
Whitepaper

Business value on AWS

27 Apr 2022

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

7 Jun 2022
Attracting and retaining talent through training
Sponsored

Attracting and retaining talent through training

13 Jun 2022
Delivery firm Yodel disrupted by cyber attack
cyber attacks

Delivery firm Yodel disrupted by cyber attack

21 Jun 2022