{"id":989649,"date":"2024-10-08T14:15:19","date_gmt":"2024-10-08T07:15:19","guid":{"rendered":"https:\/\/dbiz.vn\/?p=989649"},"modified":"2025-06-19T23:44:56","modified_gmt":"2025-06-19T16:44:56","slug":"what-is-ransomware-and-why-is-it-such-a-big-business","status":"publish","type":"post","link":"https:\/\/dibiz.vn\/en\/what-is-ransomware-and-why-is-it-such-a-big-business\/","title":{"rendered":"What is Ransomware? And Why is it Such a Big Business?"},"content":{"rendered":"
\n
\n

Between Q2 2023 and Q2 2024, KELA has tracked more than 5,000 victims of ransomware and extortion actors, and the numbers are only growing year-on-year. Ransomware has become a huge business, and monetization opportunities are far broader than just the ransom demand itself.\u00a0<\/span><\/p>\n<\/div>\n

\n

Our latest eBook takes a deep dive into the business of the ransomware supply chain, looking at headline-grabbing attacks, key personas that leverage the cybercrime underground for financial gain, and best practices for protecting your own organization.\u00a0Download the eBook here<\/a>, or keep reading for some choice highlights.<\/p>\n

How Does Ransomware Work?<\/h4>\n

When we think of ransomware, we imagine the end game \u2014 where attackers encrypt data and demand a ransom for its return. In a double extortion attack, the threat actors threaten to leak the stolen data, and in a triple extortion attack, additional methods are used such as DDoS attacks or a spam campaign, usually intended to up the pressure.<\/p>\n

 <\/p>\n

However, by the time any of these tactics become apparent to the victim, the ransomware attack is at its final stages.<\/p>\n

 <\/p>\n

A ransomware attack begins long before an organization has any idea that they are under fire. First, attackers\u00a0gather intelligence<\/b>\u00a0and conduct active reconnaissance, picking an organization that they believe may lead to a large pay-day. Attackers then need to\u00a0obtain initial access\u00a0<\/b>to the victims\u2019 network.<\/b>\u00a0They can do this by purchasing initial access from Initial Access Brokers (IABs) who have done the majority of the legwork, or through compromised employee accounts mostly obtained through infostealers which often infect a system via malicious links and attachments hidden in emails, social engineering, malvertising or perhaps as a result of software vulnerabilities.<\/p>\n

 <\/p>\n

Once inside, attackers use\u00a0lateral movement<\/b>\u00a0and privilege escalation to expand their reach, finding sensitive data or gaining control over endpoints. This puts them where they need to be for\u00a0data exfiltration,\u00a0<\/b>which they can then leverage when they threaten to leak the data, or sell it on. Only then do attackers\u00a0deploy their ransomware<\/b>, encrypting files and making them inaccessible, and establish a communication channel to\u00a0demand a ransomware payment.\u00a0<\/b><\/p>\n

The Evolution of Ransomware Attacks<\/h4>\n

Historically, a single hacker or group might have targeted an enterprise, going through all of these steps in their own silo. However, today ransomware attacks are predominantly the work of different people with different specializations, coming together to make an attack possible through the cybercrime ecosystem.<\/p>\n

 <\/p>\n

Those who have the expertise to build the malware can focus there \u2014 while others may be hired as traffers, individuals whose role it is to spread the malware far and wide, or as negotiators, who are highly-skilled in getting ransoms paid quickly. Ransomware-as-a-Service is a growing trend, and Autoshops are also more common than ever \u2014 allowing hackers to simply \u2018click-to-buy\u2019 what they need, whether that\u2019s attack tools, initial access, or lists of credentials.<\/p>\n

 <\/p>\n

The cybercrime ecosystem isn\u2019t only used to buy things, it\u2019s also a community of threat actors who can use it to recruit and coordinate for attacks, negotiate with victims, and share their own methodologies and support for one another.<\/p>\n

 <\/p>\n

These changes have allowed ransomware efforts to scale beyond what anyone could have imagined, giving attackers many more opportunities to target organizations, and providing a greater chance of financial gain.<\/p>\n

Where Do Criminals Find Initial Access in the Cybercrime Ecosystem?<\/h4>\n

 <\/p>\n

In the past year compromised valid accounts (MITRE ID: 1078<\/a>) and user credentials have become the\u00a0top initial access vector<\/a>\u00a0for cyber attacks. Criminals can find\u00a0credentials and compromised accounts<\/a>\u00a0from a combination of four main sources:<\/p>\n

 <\/p>\n