The US Federal Bureau of Investigation (FBI) has warned that ransomware operators are targeting companies that are going through financial events. The timing is designed to elicit and exploit information in ways that will exert additional pressure on the victims.
“The FBI assesses ransomware actors are very likely using significant financial events, such as mergers and acquisitions, to target and leverage victim companies for ransomware infections,” the Bureau says. “Prior to an attack, ransomware actors research publicly available information, such as a victim’s stock valuation, as well as material nonpublic information. If victims do not pay a ransom quickly, ransomware actors will threaten to disclose this information publicly, causing potential investor backlash.”
The FBI explains that ransomware operators select their victims based on the value of the information they have access to, and thus the potential for a big payout.
“Ransomware actors are targeting companies involved in significant, time-sensitive financial events to incentivize ransom payment by these victims,” the FBI says. “Ransomware is often a two-stage process beginning with an initial intrusion through a trojan malware, which allows an access broker to perform reconnaissance and determine how to best monetize the access. However, while this malware is often mass distributed, most victims of trojans are not also victims of ransomware, indicating ransomware targets are often carefully selected from a pool based on information gleaned from the initial reconnaissance.
Once ransomware operators are within a network, they search for sensitive information that they can use to further incentivize victims to pay.
“During the initial reconnaissance phase, cyber criminals identify non-publicly available information, which they threaten to release or use as leverage during the extortion to entice victims to comply with ransom demands,” the Bureau says. “Impending events that could affect a victim’s stock value, such as announcements, mergers, and acquisitions, encourage ransomware actors to target a network or adjust their timeline for extortion where access is established.” That reconnaissance phase is often the work of initial access brokers, who pick victims likely to be attractive to the brokers’ criminal customers.
The vast majority of ransomware attacks begin via phishing attacks or technical vulnerabilities like exposed RDP ports. New-school security awareness training can give your organization an essential layer of defense by helping your employees to recognize phishing and other social engineering attacks.
The FBI has the story.
Here's how it works:
