Each ransomware payment subsidises more attacks – report

Although a minority of ransomware victims pay their extorters, those that do are directly enabling between six and ten attacks on other organisations, according to research by cybersecurity firm Trend Micro.

The research found that those that agree to pay – which in this report was around 10% of firms analysed – usually do so quickly and are generally being forced to pay more per incident. It revealed that victims in some sectors and countries pay more often than others, meaning their peers are more likely to be targeted. It also concluded that paying a ransom often only results in driving up the overall cost of the incident with few other benefits.

The study showed that ransomware monetisation activities are at their lowest in January and July-August, making these potentially good times for defenders to rebuild infrastructure and prepare for future threats.

Jon Clay, VP of threat intelligence at Trend Micro, said: “Ransomware is a major cybersecurity threat to enterprises and governments today. It’s also continually evolving, which is why we need more accurate, data-driven ways to model ransomware-related risk. This new research aims to help IT decision-makers better understand their risk exposure and provide policymakers with the information they need to craft more effective and impactful strategies.”

Jointly produced by Trend Micro and Waratah Analytics, research for the report – What decision makers need to know about ransomware risk – applied data science approaches to information collected from network and host-based telemetry, underground forums, bitcoin, and financial transactions, and chat logs, alongside analysis of criminal business processes.

    Share Story:


Cyber risk in the transportation industry
The connected nature of the transport and logistics industries makes them an attractive target for hackers, with potentially disruptive and costly consequences. Between June 2020 and June 2021, the transportation industry saw an 186% increase in weekly ransomware attacks. At the same time, regulations and cyber security standards are lacking – creating weak postures across the board. This podcast explores the key risks. Published April 2022.

Political risk: A fresh perspective
CIR’s editor, Deborah Ritchie speaks with head of PCS at Verisk, Tom Johansmeyer about the confluence of political, nat cat and pandemic risks in a world that is becoming an increasingly risky place in which to do business. Published February 2022.