Ransomware costs doubled in Q4 2019

Average ransom payments soared by 104% to $84,116, up from $41,198 in the quarter

The cost of ransomware attacks more than doubled in Q4 2019, the latest research from Coveware has concluded, following a significant increase in Ryuk and Sodinokibi breaches.

The firm’s Q4 Ransomware Marketplace report, which collects anonymous ransomware data from cases handled by its Incident Response Platform, found that the average ransom payment increased by 104% to $84,116, up from $41,198 in Q3. The median ransom payment for the quarter was $41, 179.

Advertisement - Article continues below

This doubling of the average reflects the diversity of threats attacking businesses, Coveware said, with variants such as Ryuk and Sodinokibi moving into the large enterprise space to in order to extort seven-figure pay-outs. Ryuk payments, for example, were found to have hit a new high of $780, 000 for impacted businesses during the period.

Smaller firms also continued to be at risk, with ransomware as a service variants such as Dharma, Snatch and Netwalker blanketing the small business space with a high number of lower demands – sometimes as low as $1,500.

These malicious software threats are evolving, too, with ransomware attackers moving beyond just encrypting business data and adding the exfiltration of information and threat of its release if the sum is not paid.

In terms of data recovery, Q4 saw 98% of companies receiving a working decryption tool upon payment. Of that pool, victims managed to successfully decrypt 97% of their encrypted data; a slight increase over Q3.

It was also found that the average downtime for affected firms increased to 16.2 days, up from 12.1 days previously, driven by a “higher prevalence of attacks against larger enterprises” that have more complex networks to restore, Coveware said.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

It also comes as a result of ransomware evolving and implanting more advanced features. In Q4, Ryuk actors introduced a “Wake-on-LAN” feature to turn on devices with a compromised network that were originally powered off.

Essentially, the addition allows attackers to infect machines during the night when the impact of security admins is limited, ultimately maximising the number of encrypted endpoints. Ransomware as a service variant Sodinokibi was discovered to be the most prevalent type attack during the quarter, making up 29.4% of the overall total. Sodinokibi only allows a select number of affiliates to distribute the ransomware, of which usually possess specific skills to attack targets such as managed service providers.

Once an MSP’s remote monitoring and management tools (RMM) are compromised, attackers can push the ransomware to every client endpoint it manages. Sodinokibi also adapted its extortion tactics to include threatening the release of data, Coveware added.

Related Resource

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now

“Sodinokibi’s focus on MSPs results in large payouts, but relatively small victims sizes, as most companies that utilise MSPs are small enterprises with less than 200 employees,” the firm added.

Businesses fell foul to a number of ransomware attack vectors in Q4, with the top three consisting of Remote Desktop Protocol (RDP) compromise (57.4%), email phishing (26.3%) and software vulnerabilities (12.9%).

Featured Resources

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Remote working 2020: Advantages and challenges

Discover how to overcome remote working challenges

Download now

Keep your data available with snapshot technology

Synology’s solution to your data protection problem

Download now

After the lockdown - reinventing the way your business works

Your guide to ensuring business continuity, no matter the crisis

Download now
Advertisement

Recommended

How can you protect your business from crypto-ransomware?
Security

How can you protect your business from crypto-ransomware?

4 Nov 2019

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

4 Aug 2020
How do I fix the Windows 10 Start Menu if it's frozen?
operating systems

How do I fix the Windows 10 Start Menu if it's frozen?

3 Aug 2020