Cyber Defense eMagazine December Edition for 2021

Ransomware has also evolved from those early days, while initially focusing on encryption, it has now
moved to triple and even quadruple extortion. The focus of these new attacks is less about encryption,
but rather other mechanisms of making money. The typical strategies these gangs employ to make
money include.
1. Direct encryption: Encrypt files on the device and display a paywall which requires a
cryptocurrency payment before decryption takes place.
2. Data Extortion: Instead of encrypting files, cybercriminals exfiltrate data from the device in the
background, sending data to command and control (C2) servers in foreign countries like Russia
and China. A small sample of the files are published on the Dark Web as evidence and is available
for sale to other third parties.
3. Attack Notification: Prior to launching a cyberattack, ransomware gangs sell the information about
a pending attack to third parties who can use the information to short stocks or any other means
of making money from this advance notice.
4. Cryptojacking: In addition to stealing data, new ransomware variants also include the ability to
mine cryptocurrency and effectively make money by hijacking the CPU of the host device. This
allows cyber criminals to make money while avoiding the massive energy costs associated with
cryptocurrency mining. Because cryptojacking involves data exfiltration this is often overlooked
by traditional security solutions.
These new attacks are highly coordinated by well-resourced gangs that have business models and even
channel operations like a traditional business. If you want to launch an attack you can contact the gangs
directly to license their software and you must provide a percentage of the ransom paid.
The one common factor with these new approaches is they all involve some form of data exfiltration. For
any of these attacks to be successful data must be exfiltrated from the device. In fact, of the 244 reported
ransomware attacks this year, 83.3% threatened to exfiltrate data.
New data from Osterman Research reveals that despite significant investment in tools like data loss
prevention, organizations still struggle with cyberattacks and the prevention of data exfiltration. In
addition, an overwhelming majority of respondents (62%) reported that they have weak confidence in
their current solution’s ability to prevent data exfiltration or prevent ransomware (55%). This provides
clear evidence that most organizations are missing an important piece in their approach to cybersecurity.
Existing technology is ineffective in protecting what has arguably become a business’s most valuable
asset, the data itself. It’s clear that more needs to be done to ensure organizations are able to lock down
their critical information in the face of mounting attacks. And it’s not just external cyber adversaries that
pose a risk. The majority of organizations (59%) lack confidence in their current solutions ability to prevent
insiders from exfiltrating data, and nearly half (41%) have experienced an employee’s mistake resulting
in data exfiltration. The human element cannot be overlooked when it comes to security – especially in
Cyber Defense eMagazine – December 2021 Edition 94
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.