Last year marked a significantly troubling year for cybersecurity amid an increasingly dangerous ransomware landscape. The emergence of new attackers brought about more sophisticated attack methods and an increased frequency of ransomware incidents. As a result, net global ransomware payments climbed to one billion dollars.
Now, as we reflect on the ransomware surge in 2023, we aim to better prepare for the challenges anticipated in 2024. Securin’s Ransomware Report: 2023 Year in Review, analyzing the 230,648 Common Vulnerabilities and Exposures (CVEs) listed in the National Vulnerability Database (NVD) and prioritizing them on severity, affected systems, and vulnerability characteristics. The findings revealed some key insights on where ransomware is headed in 2024, especially in the government sector.
Ransomware’s Steady Climb
Chronicling last year’s ransomware threats, attack groups, their impact, and how the attacks ended in a costly aftermath, it’s no surprise to find ransomware attacks have become more common. Unfortunately, they have also become more expensive with the average ransom costing almost $5.11 million. These attacks can also lead to significant downtime lasting days or even weeks, completely gutting business operations and leading to more lost revenue.
Of note, the government sector has had a brutal year, suffering major cyberattacks that took down operations and exploited highly sensitive information. The report illustrates two examples of this when both the city of Dallas and the city of Oakland fell victim to debilitating attacks, wherein thousands of personal and financial records were accessed and stolen.
In the Dallas attack, the Royal ransomware gang stole over 27,000 employees’ personally identifiable information (PII) and caused a widespread network outage for the city’s police department, fire rescue, municipal courts, and more. Dallas’ city council approved to pay $8.5 million dollars in expenses related to the attack.
The Oakland ransomware attack forced the city to declare a state of emergency after having to shut down most of the city’s services. The Play ransomware group behind the attack stole full employee information, passports, IDs, and human rights violation information. These incidents underscore the ruthless tactics employed by contemporary cybercriminals and highlight their severe cost, both monetarily and operationally.
New Threats Emerging
In 2023, the landscape of ransomware-associated vulnerabilities saw a significant surge, escalating from 344 instances in 2022 to 382 according to the new report. These vulnerabilities provide even more avenues for attackers to exploit. Probably the most exploited among these vulnerabilities was the Progress MOVEit Transfer Vulnerability (CVE-2023-34362). This exploit proved particularly effective, resulting in the compromise of over 1,000 organizations and impacting the data security of about 60 million individuals.
Moreover, the year witnessed the emergence of ten new ransomware families, including Akira, Bloody, and INC, thereby contributing to a total tally of 188 active ransomware families. Notably, security analysts at Securin also detected a concerning trend as three existing advanced persistent threat (APT) groups—Scattered Spider, FIN8, and RomCom—expanded their operations to include ransomware attacks, diversifying their arsenal and intensifying the threat landscape.
Among the myriad of ransomware groups that surfaced in 2023, Cl0p, BlackCat, and Vice Society emerged as prominent entities. These groups orchestrated damaging attacks against various high-profile targets, including MGM Resorts, MOVEit Transfer, and the Industrial and Commercial Bank of China, underscoring the pervasive and disruptive nature of ransomware attacks on global entities.
After speaking with customers throughout the past year, Securin notes it has become clear that cyberattacks, whether successful or prevented, occur frequently and are not unexpected. This, combined with a shortage of skilled professionals in the field and reduced IT budgets, has created a volatile situation for businesses and organizations of all types. To prevent the worst from happening in 2024, it’s crucial to face these challenges head-on with the best information available.
We Must Secure Now for the Future
As we look ahead to 2024, government agencies need to prepare their networks and teams for increased attacks. Sensitive data and credentials are frequently exposed to newly discovered vulnerabilities and weaknesses. Therefore, security leaders must take the necessary measures to stay ahead of the latest ransomware threats and implement preventive methods that can effectively protect against such attacks. Basic measures like user permissions, password two-factor authentication, and software updates can go a long way in preventing cyber security breaches. Organizations should also consider scheduling routine backups to ensure critical data can be restored in the event of a ransomware attack.
Bolstering governmental cyber resilience is critical in today’s constantly evolving threat landscape. Federal organizations must fortify their defenses through employee education and training, regular software updates, patch management, continuous attack surface monitoring, and other proactive mitigation measures to better secure their future. Safeguarding this data is paramount, as it pertains to government operations and public citizens, highlighting the critical need for robust cybersecurity measures to preserve public trust and maintain the integrity of essential services.
The author, Ram Movva, is CEO of Securin.