Cyber-Zombie Apocalypse: Ransomware Gangs Continue to Come Back from the Dead

With ransomware gangs making so much money and then dropping off the face of the earth, what’s the motivation to come back to life and potentially risk getting caught?

We saw REvil come back from the shadows and hit a Fortune 500 company last month. Similarly, we saw BlackByte do the same thing brandishing a new extortion strategy. And then there’s the ransomware-as-a-service groups like Conti who have been shut down – leaving us wondering if (and, more likely, when) they will spring up as a new ransomware variant.

If they’re making so much money – as the total ransomware take is estimated by Cybersecurity Ventures to be over $20 billion last year – why shut down and, more importantly, why bother coming back?

There are a few reasons why ransomware gangs continue to come back from the dead:

• They want to change their stripes – we saw the government specifically crack down on REvil last year, even offering a reward for information leading to their capture. This kind of pressure from authorities is enough for a gang to want to run and hide… that is, until they recode their wares and rebrand themselves as a new gang.
• They join a cartel or change their business model – some of the recent ransomware cartels have formed to share techniques, code, and infrastructure. Others switch from a business model where the gang themselves develops the ransomware code and performs the attacks to an affiliate model to offset the risk of being the threat actors specifically targeted by authorities.
• There’s plenty of money in it – in addition to Cybersecurity Ventures predicting 2021 ransomware costs, they also project that ransomware will cost $265 billion by 2031. So, if you’re really good at ransomware, you may not want to stop, as there may be more money left on the proverbial ransomware table to be taken.

No matter the reason, we should assume that in cases other than when the gangs are arrested and put behind bars, like any other industry where someone has experience and skills, those responsible for ransomware will continue to spawn up with a new version in an attempt to make as much money before they have to hide… and do it again.