A 12 month study of recent ransomware trends by cloud security company Zscaler found the barrier of entry has decreased, while cyberattacks have grown in sophistication, due to the prevalence of RaaS, a model where threat actors sell their services on the dark web for 70-80% of ransomware profits.

This business model has continued to increase in popularity over the last few years as evidenced by the frequency of ransomware attacks, which increased by nearly 40% over the last year.

“Ransomware-as-a-Service has contributed to a steady rise in sophisticated ransomware attacks,” said Deepen Desai, Global CISO and Head of Security Research, Zscaler.

“Ransomware authors are increasingly staying under the radar by launching encryption-less attacks which involve large volumes of data exfiltration. Organisations must move away from using legacy point products and instead migrate to a fully integrated zero trust platform that minimises their attack surface, prevents compromise, reduces the blast radius in the event of a successful attack, and prevents data exfiltration.”

The United States was the most targeted country by double-extortion ransomware attacks, with 40% of all victims calling this region home. The following three countries combined, Canada, United Kingdom, and Germany, had less than half of the attacks that targeted U.S. entities.

Over the last year, the most-targeted market sector globally was manufacturing, where intellectual property and critical infrastructure are attractive targets for ransomware groups. All ransomware groups tracked by Zscaler victimised businesses in this industry, which included companies engaged in goods production for sectors including automotive, electronics, and textiles - just to name a few.

Growing Trends in Ransomware

In 2021, ThreatLabz observed 19 ransomware families that adopted double or multi-extortion approaches to their cyberattacks. This has since grown to 44 ransomware families observed. The reason these types of attacks are popular is because after they encrypt the stolen data, attackers threaten to leak the data online to further increase the pressure on victims to pay.

The increasing popularity of Encryptionless Extortion attacks, which skips over the process of encryption, employs the same tactic of threatening to leak victims’ data online if they don’t pay. This tactic results in faster and larger profits for ransomware gangs by eliminating software development cycles and decryption support.

These attacks are also harder to detect and receive less attention from the authorities because they do not lock key files and systems or cause the downtime associated with recovery. Therefore, Encryptionless Extortion attacks tend to not disrupt their victims’ business operations - which subsequently results in lower reporting rates