IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

IBM: Ransomware incidents "exploded" in June

IBM Security X-Force report also finds that ransom demands are increasing to as much as $40 million

IBM says ransomware incidents "exploded" in June 2020, which saw twice as many ransomware attacks as the month prior.

The month of June accounted for one-third of all the ransomware attacks dealt with by IBM Security X-Force Incident Response this year so far, according to new findings published this week.

According to the report, one in four cyber security incidents in 2020 so far had been caused by ransomware, and IBM warns that ransom demands are also rapidly increasing, with some demands surpassing $40 million (£31 million).

Out of all ransomware attacks IBM observed, 29% were made up of the Sodinokibi (also known as REvil) ransomware-as-a-service (RaaS) attack model, which previously targeted entertainment and media law firm Grubman Shire Meiselas and Sacks.

In May, attackers claimed to have used the ransomware strain to compromise 756GB of data including contracts and personal emails belonging to high-profile celebrities such as Madonna, Lady Gaga and Bruce Springsteen.

Sodinokibi was also used in the January attack on foreign exchange company Travelex, which was kept offline for weeks and reportedly cost the firm £25 million.

IBM Security X-Force found that Sodinokibi had managed to attack over 140 organisations since its emergence in April 2019, most often targeting industries such as the wholesale sector (19%), manufacturing (18%) and professional services (16%). 

Three in five of the targeted organisations were based in the US, followed by the UK, Australia, and Canada.

According to the findings, over 36% of Sodinokibi victims decided to pay the ransom, and 12% of victims had their sensitive data sold in an auction on the dark web for prices ranging from $5,000 to more than $20 million.

IBM Security X-Force also managed to identify which cyber crime threat group is behind the elusive malware.

In a blog post detailing the findings, X-Force IRIS global security intelligence analyst Camille Singleton said that the team found “evidence suggesting that ITG14 — which shares campaign overlap with FIN7 — is at least one affiliate group connected to these attacks”. 

“After investigating a Carbanak backdoor associated with a Sodinokibi ransomware attack, we discovered this Carbanak sample was similar to new Carbanak 64-bit variants, which have been connected to ITG14 tools and techniques. We also assess this sample is used exclusively by the group. This leads us to conclude that ITG14 is at least one affiliate group that contracts with Sodinokibi RaaS providers to deliver these attacks,” she explained.

IBM recommendeds that, in order to mitigate the risks of ransomware, companies should establish and maintain offline file backups, implement a strategy to prevent unauthorized data theft, employ multi-factor authentication and user behavior analytics, and conduct penetration testing to identify vulnerabilities.

Featured Resources

The Total Economic Impact™ Of Turbonomic Application Resource Management for IBM Cloud® Paks

Business benefits and cost savings enabled by IBM Turbonomic Application Resource Management

Free Download

The Total Economic Impact™ of IBM Watson Assistant

Cost savings and business benefits enabled by Watson Assistant

Free Download

The field guide to application modernisation

Moving forward with your enterprise application portfolio

Free Download

AI for customer service

Discover the industry-leading AI platform that customers and employees want to use

Free Download

Recommended

Ransomware now strikes one in 40 organisations per week, Check Point finds
ransomware

Ransomware now strikes one in 40 organisations per week, Check Point finds

27 Jul 2022
IT Pro News In Review: UK 4 day week, ransomware payment rise, IBM cut ties with Russia
Business operations

IT Pro News In Review: UK 4 day week, ransomware payment rise, IBM cut ties with Russia

10 Jun 2022
IBM bolsters cyber security offerings with Randori acquisition
mergers and acquisitions

IBM bolsters cyber security offerings with Randori acquisition

7 Jun 2022
Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022

Most Popular

Apple patches 'superpower' zero-days affecting iPhones, iPads, and Macs
zero-day exploit

Apple patches 'superpower' zero-days affecting iPhones, iPads, and Macs

18 Aug 2022
Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
The benefits of a hardware update for SMBs
Sponsored

The benefits of a hardware update for SMBs

2 Aug 2022