Ransomware Explained - Understanding the Attackers

Know your enemy. This is what Sun Tzu instructed over 2,000 years ago as the author of the legendary work, The Art of War. His insights, a staple at war colleges and business classes even today, still provides valuable insights for gaining advantages against intelligent adversaries. So when we look at the problem of ransomware, we must take the time to understand the threat agents behind the attacks. The people behind ransomware, they're a mixed bunch. Understanding their motivations, objectives, and capabilities provides great insights to what they will target and the likely methods that they will use. It can afford opportunities to leverage various techniques to predict, deter, dissuade, undermine, respond, and protect from attacks. If we leverage threat agent archetype methodologies that have been refined over the past decade and are now in use by NIST and various government agencies around the globe, we can classify the attackers behind ransomware and benefit from those valuable insights. So let's break it down. Based upon the activities we've witnessed over the past two decades, ransomware attackers fall into four basic groups with one being the most dominant. First are the nation states, and these are the ones who are seeking hard currency. These are often nations that are under enormous international political and economic pressure with limited trade access. They're often embargoed or have multiple layers of embargoes and sanctions, which greatly limits their ability to get hard currency on the open market for the goods and resources from their country. They need international currency to purchase technology, weapons, and other desirables from other countries, often to keep such regimes in power. They either employ government talent to conduct international ransomware, or they sponsor it by contracting with cyber mercenaries, uh, essentially hacker groups for hire to do the dirty work for them. North Korea and Iran are probably the best known for these tactics and have likely siphoned billions of dollars from Western and pro-Western countries. Now, the second group is also nation-states, but it's completely different objective, and it's more offensive in nature. These are nation-state cyber warriors and often report into either the military or intelligence apparatus. They're attempting to cause disruption, harm, or to send a pressuring political message. Now they use ransomware as a deceptive technique to make it look like something else, to mask the attackers behind a veil of plausible deniability. Now the money gained is a nice bonus. I mean, that can feed more activities, but the targets are actually selected and they're in, in a way that they're primarily tied to a political motive of some kind. These attacks are often attempting to put pressure on foreign adversaries or simply send a thinly concealed threatening message that basically says that you can be victimized. We can reach out and we can harm you. Now, conducting an attack through the use of ransomware can deflect attribution away from the aggressor while still influencing the policies of the target. And more powerful countries play in this particular arena. And this is but one of many offensive cyber-related tools at their disposal, uh, which may be used in conjunction with each other as part of a larger campaign. Overall, these are very selective attacks and may cause specific damage to government services military defenses, national critical infrastructures, major businesses, important industries, or even government suppliers. All right, the third and the fourth groups by far are the largest, and those are cyber criminals. Now, these are individuals, groups, even professional organizations that have a single motivation, personal financial gain. Basically, they are the digital thieves using ransomware to extort money for their benefit. They often don't care where the money comes from. They just want the money. From a risk perspective, the nation states that, that are seeking hard currency and are conducting cyber warfare activities, they are the best overall resourced. They have the best tools. They have the ability to focus on specific targets like government functions or, you know, various critical infrastructures that are vital to a nation. They are the most capable, but these attacks are fairly scarce, uh, even if they are impactful. Instead, it's those everyday cyber criminals who conduct the vast majority of attacks, which they can be split into kind of two groups, uh, according to their skill level. Now, on the one hand, you have skilled hackers, and these have the technical savvy to target well-defended organizations, and they're the ones seeking premium payments from sectors that they believe will pay. And that's the first group, and, and consider them kind of the elite. The second group is at the bottom of that pyramid, if you will, and they're considered the unskilled attackers. And often they're new to the scene and they take part in entry-level cybercriminal work and many times begin their career by signing up as an affiliate with a ransomware as a service operation. Skilled cybercriminal crews, they're the elite and often pull off spectacular heists for millions of dollars. They can aim higher and target more valuable victims. They often show great patience, thoroughness, and professionalism. It's like a predator, right? Once they identify their target, they will pursue it with great vigor until they find a way to succeed. And they really are a force to be reckoned with. Now, some of these groups have boasted they've made over a billion dollars in totality. It's also suspected that some of these teams will work for nation-states under contract as those cyber mercenaries from time to time. But there are very few of these teams in operation. There's not hundreds of thousands of them or millions of them. It really is an elite class. Several of these groups have realized the best way to operate is by creating a, a framework that can enlist others in order to scale the operations. Such desires were the origins of ransomware as a service and the entire pyramid scheme that empowers the unskilled hackers to quickly enter the world of cybercrime for profit. This is where cybersecurity strategists such as myself, looking into the future, begin to get very worried. Now follow me along here for a second. Most of the current 4.7 billion internet users, they're from affluent countries or they benefit from a higher than average financial status. Now in reality, most of the world makes less than $20 a day, and they hustle every waking moment to survive or, or try and get ahead a little bit. It's sustenance living, often in areas which don't offer much in the way of economic opportunities, jobs, and so forth. And as the internet is quickly expanding across the globe to connect the remaining 40% of the planet that currently isn't on the internet, internet, when we look at the next billion people who are going to join, they're going to be looking for opportunities, craving it, to improve their lives and economic future. And the lure of easy money through the distribution of ransomware may simply be too attractive to resist. And the biggest factor there for this recruitment is the reinforcement that they're gonna get paid. As long as ransoms are being paid and it's lucrative for the attackers, more and more people will join the ranks. A good number of the next billion users joining the internet will see it as an opportunity to make much more than the $20 a day sustenance living that they currently experience. And very soon we will have a lot more desperate and motivated entry-level attackers that will flood the world with creative and persistent lures, attacks, phishing, and social engineering ploys in search of victims. And again, they're going to be empowered by the high-level technology of that ransomware as a service framework, so they don't need to have any technical skills at all. So let's finish our discussion today with how cybercriminals identify which targets to pursue. Again, cybercriminals are driven by greed and often are opportunistic. They weigh the amount of effort necessary against the likely return they're going to get. Well, just like all of us really. And not surprisingly, they tend to follow the path of least resistance in pursuit of their goals. Targeting tends to be predictable as they look for targets of great value and victims who are easy. As a rule, criminals focus really on two types of targets: number one, the easy victims Those are the ones that possess little technical, behavioral, or process security, and it's, it's a low effort, but it's also a likely low return for the attackers. And so scale is really the key to success there. And this is where the lower-end criminals tend to start, and eventually they get more confident to pursue larger marks. Now, the second type of victim are ones that are valuable. So valuable targets. This is where large sums can be extorted, but it may take much more time, skill, and effort. These are the targets of the skilled professional cybercriminals who conduct the research, who do the reconnaissance and plan out well-orchestrated attacks that in some cases can take months to complete. So in conclusion, most attacks seek monetary returns, and it's at the crossroads where minimum effort returns the maximum results. And understand that all the ransomware threat agents, the nation-states and cybercriminals, often use social engineering attacks as they are the easiest to conduct and they actually have a good chance of success over time. The best general advice? Well, number one, don't be an easy target. Implement the cybersecurity basics and compared to others, be well above average. You know, there's, there's an adage out there: you don't have to outrun the attacking bear, you just have to outrun the person next to you. And it kind of plays in this, right? Don't be the easy victim. And secondly, protect your valuables. Know what's important to you. You're not protecting everything equally. You need to protect your valuables more. If you have something of great value, take equitable care in protecting it. The higher the value, the more protection you need. Don't ignore the risks and proactively apply the most security around what is most valuable. Knowing if you're going to be a target of those nation-states is also important because that will determine if the investment of security really must rise to the capabilities of those attackers. So if you fall into the category of likely being attacked, well, you need to up your game. Thank you for watching. This is one session of a multi-part series on ransomware. The series is free on Cybersecurity Insights YouTube channel. And as the security industry, the business leaders and government professionals, we, we all grow stronger to defend against cyber threats the more we share and collaborate. So I urge you to subscribe and to watch all the videos for strategic insights that fuel the ransomware events unfolding in the news and impacting all of us.