Ransomware costs doubled in Q4 2019

Average ransom payments soared by 104% to $84,116, up from $41,198 in the quarter

The cost of ransomware attacks more than doubled in Q4 2019, the latest research from Coveware has concluded, following a significant increase in Ryuk and Sodinokibi breaches.

The firm’s Q4 Ransomware Marketplace report, which collects anonymous ransomware data from cases handled by its Incident Response Platform, found that the average ransom payment increased by 104% to $84,116, up from $41,198 in Q3. The median ransom payment for the quarter was $41, 179.

This doubling of the average reflects the diversity of threats attacking businesses, Coveware said, with variants such as Ryuk and Sodinokibi moving into the large enterprise space to in order to extort seven-figure pay-outs. Ryuk payments, for example, were found to have hit a new high of $780, 000 for impacted businesses during the period.

Smaller firms also continued to be at risk, with ransomware as a service variants such as Dharma, Snatch and Netwalker blanketing the small business space with a high number of lower demands – sometimes as low as $1,500.

These malicious software threats are evolving, too, with ransomware attackers moving beyond just encrypting business data and adding the exfiltration of information and threat of its release if the sum is not paid.

In terms of data recovery, Q4 saw 98% of companies receiving a working decryption tool upon payment. Of that pool, victims managed to successfully decrypt 97% of their encrypted data; a slight increase over Q3.

It was also found that the average downtime for affected firms increased to 16.2 days, up from 12.1 days previously, driven by a “higher prevalence of attacks against larger enterprises” that have more complex networks to restore, Coveware said.

It also comes as a result of ransomware evolving and implanting more advanced features. In Q4, Ryuk actors introduced a “Wake-on-LAN” feature to turn on devices with a compromised network that were originally powered off.

Essentially, the addition allows attackers to infect machines during the night when the impact of security admins is limited, ultimately maximising the number of encrypted endpoints. Ransomware as a service variant Sodinokibi was discovered to be the most prevalent type attack during the quarter, making up 29.4% of the overall total. Sodinokibi only allows a select number of affiliates to distribute the ransomware, of which usually possess specific skills to attack targets such as managed service providers.

Once an MSP’s remote monitoring and management tools (RMM) are compromised, attackers can push the ransomware to every client endpoint it manages. Sodinokibi also adapted its extortion tactics to include threatening the release of data, Coveware added.

Related Resource

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now

“Sodinokibi’s focus on MSPs results in large payouts, but relatively small victims sizes, as most companies that utilise MSPs are small enterprises with less than 200 employees,” the firm added.

Businesses fell foul to a number of ransomware attack vectors in Q4, with the top three consisting of Remote Desktop Protocol (RDP) compromise (57.4%), email phishing (26.3%) and software vulnerabilities (12.9%).

Featured Resources

Digital Risk Report 2020

A global view into the impact of digital transformation on risk and security management

Download now

6 ways your business could suffer if you don’t backup Office 365

Office 365 makes it easy to lose valuable data regularly, unpredictably, unintentionally, and for good

Download now

Get the best out of your workforce

7 steps to unleashing their true potential with robotic process automation

Download now

8 digital best practices for IT professionals

Don't leave anything to chance when going digital

Download now



How can you protect your business from crypto-ransomware?

4 Nov 2019

Most Popular


How to use Chromecast without Wi-Fi

5 Feb 2020
operating systems

How to fix a stuck Windows 10 update

12 Feb 2020

The top ten password-cracking techniques used by hackers

10 Feb 2020

Microsoft to add Defender antivirus software to Linux, iOS and Android

21 Feb 2020