In 2023 [1] [2] [3], there was a significant increase in the number of new multipoint extortion ransomware groups [2]. These groups, connected to older ransomware operations [2] [4], employ various tactics to coerce victims into paying a ransom, including data theft and threats of data publication. This article explores the rise of these groups and highlights the advantages they offer to defenders.
Description
Cybersecurity company WithSecure has observed a surge in the emergence of new multipoint extortion ransomware groups [2], with nearly half of the tracked ransomware groups initiating operations. Many of these new groups have clear connections to previous ransomware operations [2] [4]. To pressure victims into paying a ransom [2], these groups employ different methods, such as stealing and threatening to release data. The leaked source code for Conti, Lockbit [1] [2] [3], and Babuk ransomware has been utilized by other ransomware gangs, contributing to the increase in data leaks [1]. WithSecure has identified a total of 60 multipoint extortion ransomware gangs, with 29 of them being newly established [4]. Despite the growing number of ransomware attacks, the predictability of these groups offers advantages to defenders. Organizations can leverage their incident response and cyber-resilience efforts to prepare for the inevitable targeting by ransomware gangs.
Conclusion
The rise of new multipoint extortion ransomware groups poses significant challenges for cybersecurity. The use of stolen source code and the threat of data publication have led to an increase in data leaks. However, the predictability of these groups provides defenders with an opportunity to enhance their defenses. By focusing on incident response and cyber-resilience efforts [1] [3], organizations can better prepare for potential ransomware attacks. Mitigating the impact of these attacks and safeguarding against future threats should be a priority for all entities.
References
[1] https://www.infosecurity-magazine.com/news/half-ransomware-operating-2023-new/
[2] https://siliconangle.com/2023/11/16/report-finds-surge-new-multi-point-extortion-ransomware-groups-2023/
[3] https://ciso2ciso.com/half-of-ransomware-groups-operating-in-2023-are-new-source-www-infosecurity-magazine-com/
[4] https://betanews.com/2023/11/16/new-ransomware-groups-account-for-a-quarter-of-all-leaks/
