Data Theft Is The New Ransomware Normal As Demands Average $600,000

Nearly All Ransomware Attacks Now Steal Data Rather Than Just Encrypt It

As one of the world’s most infamous ransomware gangs, Lockbit, warns, it has data that could destroy the FBI, enterprises need to be more concerned with a shift in cybercrime tactics that could destroy their business. Here’s what you need to know.

Ransomware Has A Very Long Tail Of Threat Actors

Referring to the ransomware landscape as a modern-day hydra, the Arctic Wolf report said that the by-now very well-established ransomware-as-a-service model has "democratized access to ransomware software, intrusion tools, and — via initial access brokers — IT environments." The end result is a very long tail of threat actors, all of whom are looking for a profitable piece of the cybercrime pie. Arctic Wolf analysts observed more than 50 unique ransomware threat actors in victim environments., the report stated. "Like the Hydra of Greek mythology," the report said, "when a ransomware operation ceases to exist — whether due to law-enforcement operations, infighting, politics or retirement — other groups (new and old) fill the void."

The Ransomware Landscape Has Evolved

A Feb. 26 report from Arctic Wolf has revealed that 96% of all reported ransomware incidents across 2024 included data exfiltration as attackers double down on leveraging the extortion threat. The newly published research shows that the double extortion tactic of stealing data as well as encrypting it, introduced by ransomware actors in response to stronger backup and respiration capabilities of potential victims, along with a better understanding of the threat itself, is no longer the exception but the norm. This "highlights a critical shift in cybercriminal behavior," Kerri Shafer-Page, vice president of incident response at Arctic Wolf, said; "Threat actors are no longer just locking up data with ransomware; they’re stealing it first to maximize pressure on victims." Doing so helps to protect the revenue streams of these organized criminal operations.

How Profitable is the Ransomware Business?

According to Arctic Wolf, median ransom demands across 2024 came in at $600,000, "demonstrating that ransomware remains a lucrative business for cybercriminals despite increased law enforcement action."

Conclusion

The shift in ransomware tactics from just encrypting data to stealing it first is a cause for concern for enterprises. With the ransomware landscape evolving and the number of threat actors increasing, it is essential for organizations to stay vigilant and take necessary measures to protect their data and systems.

Frequently Asked Questions

Q: What is the new trend in ransomware attacks?
A: The new trend is that ransomware gangs are stealing data before encrypting it to maximize pressure on victims.

Q: How many ransomware threat actors were observed in victim environments?
A: More than 50 unique ransomware threat actors were observed in victim environments.

Q: How much do median ransom demands come in?
A: Median ransom demands across 2024 came in at $600,000.