Ransomware Volume Nearly Doubles 2021 Totals in a Single Quarter

Like a hydra, every time one ransomware gang drops out (REvil or Conti), plenty more step up to fill the void (Black Basta).

After a 2021 beleaguered by ransomware, attack volumes continue to balloon in 2022. In fact, a report issued Tuesday indicates that in just the first three months of this year, the volume of ransomware detections almost doubled the total volume reported for all of last year.
The increasingly high numbers came in spite of what appeared to be the downfall of a major ransomware group at the end of 2021: REvil. This serves as a testament to the persistence of criminal actors in reforming, rebranding, and regrouping their criminal gangs to profit handsomely off of ransomware tactics.
This persistence has been studied most recently by security researchers who have noted the rapid rise of the Black Basta ransomware gang in the past two months, quickly following the emergence of the
LAPSUS$ group
earlier in the year.
The numbers today come by way of the quarterly
Internet Security Report
from WatchGuard Threat Lab, which examines Q1 2022 threat trends. Researchers with the firm report that unique ransomware detections in the first three months of the year were triple the volume of the same time period in 2021. Meantime, Q1 2022 ransomware volume equaled more than 80% of the total volume recorded in all of 2021.
“Based on the early spike in ransomware this year and data from previous quarters, we predict 2022 will break our record for annual ransomware detections,” says WatchGuard chief security officer Corey Nachreiner, noting that the last annual high-water mark for ransomware volume came back in 2018.
LAPSUS$ Steps Up in the Underground Economy
The report from his team explains that even in the face of high-profile arrests and charges made by
US
and
Russian
authorities in late 2021 and early 2022 that resulted in the disruption of the prolific REvil ransomware gang, the ransomware hits keep coming. Their analysis shows that REvil’s disruption “opened the door” for LAPSUS$ to emerge in a big way.
“The LAPSUS$ group made global headlines with their
double-extortion ransomware techniques
that caused cybersecurity decision-makers to take notice,” the report states. “The group was known to hire employees of organizations to steal information from the inside and then use extortion techniques to blackmail victim organizations. Their victim list also put decision makers on notice. Microsoft, Nvidia, Samsung, Ubisoft, Okta, and T-Mobile are all victims of LAPSUS$.”
This kind of resurgence of new groups should dampen security teams celebrations of the demise of groups like REvil and Conti, which in May were reported to have shut down their operations.
Stats from NCC Group
show a slight dip in attacks that month, with a warning that other heads of the ransomware gang Hydra were already starting to emerge.
Most recently, the Black Basta ransomware gang has surged into the scene. Earlier in the month,
two separate reports
from Uptycs and NCC Group showed that Black Basta was targeting ESXi-based systems and servers among other victims, and leveraging the Qbot malware family (aka Qakbot) to maintain persistence on networks it goes after.
While Black Basta isnt the first to develop capabilities against ESXi (LockBit, Hive, and Cheerscrypt already have demonstrated ESXi capabilities), this shows the relative sophistication of the teams working under Black Basta performing the ransomware operations, said Jake Williams, executive director of cyber threat intelligence at SCYTHE, in a statement provided to Dark Reading. Use of commodity malware like Qakbot demonstrates that there is no such thing as a commodity malware infection. Organizations must treat every malware detection as an opportunity for a threat actor to deploy ransomware.
Meantime, an
advisory report
from the Cybereason Nocturnus research team last week offered further details about Black Basta’s tactics, techniques, and procedures. They deemed the threat from the group to be highly severe, as it has victimized more than 50 companies in English-speaking countries worldwide since April. Researchers said the hallmark of the firm is its use of double extortion – i.e., stealing sensitive files and information and using it to extort victims by threatening publication of the details unless a ransom is paid. The amounts asked for are often in the millions.
The sudden rise of Black Basta has some speculating that the group is actually just a regrouping of the two most recently disbanded groups.
“Due to their rapid ascension and the precision of their attacks, Black Basta is likely operated by former members of the defunct Conti and REvil gangs, the two most profitable ransomware gangs in 2021,” says Lior Div, CEO of Cybereason.

Last News
▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Ransomware Volume Nearly Doubles 2021 Totals in a Single Quarter