New analysis of ransomware attacks by security vendor Digital Shadows in their Ransomware Q3 Roll Up highlights the current state of data leak site use with a peek into what may be to come.
One of the ransomware tactics that has evolved in the last year is the use of extortion and data leak sites to double down on ways to ensure ransoms get paid. But new insight from Digital Shadows shows a slowdown last quarter in their use, and provides some possible insight into why.
According to Digital Shadows, the number of victim organizations posted to data leak sites (571) decreased in Q3 by 13% from that of Q2. What makes this so interesting is that the highest publisher of named organizations last quarter was Lockbit, dwarfing the previous leader, Conti, by 3 times the number of posts. Had Lockbit not been so busy, the number would have diminished to less than 370 – which would have represented a 43% decrease!
Digital Shadows has also noted seeing a shift by some ransomware groups to use public file-sharing websites on the public-facing Internet, rather than managing their own dark web-based data leak site. They cite possible challenges to managing such sites, as well as slower speeds on the dark web. They see two possible outcomes in Q4 – either more use of public-facing sites, or perhaps scrapping publishing of data leaks entirely in lieu of other methods of extortion.
It’s also interesting to note that the three most-targeted sectors were Industrial Goods & Services, Technology, and Construction & Materials, with Technology experiencing a nearly 30% increase in the number of attacks by ransomware groups. And the United States was the primary focus of ransomware attacks last quarter, literally outpacing the sum of all the other top 12 countries targeted combined!
Organizations in these sectors in the U.S. should be very wary of phishing attacks intent on delivering ransomware. Use of Security Awareness Training is a prudent step to educate users to identify and avoid engaging malicious content in email and on the web.
Here's how it works:
