As we look forward to 2023, we can find many ransomware lessons in looking back at 2022. The year brought us numerous attacks by many of the same gangs we’ve watched for years, as well as some newcomers.

Many ransomware gangs operate like businesses, with their own marketing departments and user documentation. With the advent of Ransomware-as-a-Service (RaaS), gangs now sell their software to other criminals and get a portion of the profits — revenue without having to lift even a virtual finger.

But just like legitimate companies, some gangs are more successful than others. By understanding recent and common tactics, companies can create an effective plan to thwart ransomware attacks in the new year.

Here are four ransomware gangs that made headlines in 2022:

LockBit

LockBit had a big year — especially in May when the group was responsible for 40% of all ransomware attacks. The group even bragged on social media that it attacked 12,125 organizations, including Thales Ground and the French Ministry of Justice.

One of the biggest reasons the group made the headlines in 2022 was its release of a new ransomware variant, dubbed LockBit 3.0. While the group targeted organizations worldwide, the United States was the top target with the most victims. LockBit also made headlines this year by being the first group to launch its own bug bounty program, offering up to a million dollars to those willing to share sensitive personal information with them.

LockBit’s attack method of using a propriety information stealer and downloading browser data to its secure server separates it from other groups. LockBit was also one of several gangs that appeared to be “dead” and then become active again.

REvil

A story about the top gangs of 2022 wouldn’t be complete without REvil, even though the group had an official death date of May 2022.

Many group members were arrested in Russia in early 2022, but they are now back up and running, causing business disruption with their attacks. The resurrected REvil is using many of the same strategies, such as creating and attaching a random extension to affected files. However, attacks now use an updated encrypter, which makes it easier for the gang to target its attacks.

Read the Ransomware Guide  

BlackCat (ALPHV)

This group is new on the ransomware scene, launching its first official attack in 2021. The FBI reported that members are connected to the BlackMatter/DarkSide Group.

BlackCat has launched attacks on more than 60 organizations, targeting both nonprofits and corporations in industries ranging from technology to real estate. Among its high-profile attacks was one on the Austrian federal state Carinthia, in which they demanded a $5 million ransom. Additionally, the group has the distinction of being the first to launch an attack on an organization using RUST, which is typically considered to be one of the more secure programming languages.

BlackCat’s attacks tend to use a similar approach: gaining access through previously compromised credentials and then using distributed denial-of-service (DDoS) attacks. The attacks start by taking over Active Directory user and administrator accounts and then deploying the ransomware. Ransoms are usually requested to be paid in Bitcoin and Monero, but the gang has settled for ransom payments lower than the demanded amount.

Black Basta

Many of Black Basta’s members were previously part of the Conti and REvil ransomware gangs. The group’s first known attack happened in April 2022, when the American Dental Association was forced to shut down services to members, including online, telephone, chat and email. Other victims included the building and construction firm Knauf and the agriculture equipment company AGCO.

Black Basta specializes in using a RaaS double-extortion technique, which renders the victim’s data unusable and threatens to make sensitive information public. Like many other groups, Black Basta tends to rely on DDoS attacks to increase the odds that the target will pay the ransom demanded.

As we move into 2023, cybersecurity professionals should leverage the lessons we’ve learned and the ransomware tactics we’ve seen in 2022 to help make organizations safer and more secure.

More from Risk Management

Increasingly Sophisticated Cyberattacks Target Healthcare

4 min read - It’s rare to see 100% agreement on a survey. But Porter Research found consensus from business leaders across the provider, payer and pharmaceutical/life sciences industries. Every single person agreed that “growing hacker sophistication” is the primary driver behind the increase in ransomware attacks. In response to the findings, the American Hospital Association told Porter Research, “Not only are cyber criminals more organized than they were in the past, but they are often more skilled and sophisticated.” Although not unanimous, the…

4 min read

Machine Learning Applications in the Cybersecurity Space

3 min read - Machine learning is one of the hottest areas in data science. This subset of artificial intelligence allows a system to learn from data and make accurate predictions, identify anomalies or make recommendations using different techniques. Machine learning techniques extract information from vast amounts of data and transform it into valuable business knowledge. While most industries use these techniques, they are especially prominent in the finance, marketing, healthcare, retail and cybersecurity sectors. Machine learning can also address new cyber threats. There…

3 min read

Now Social Engineering Attackers Have AI. Do You? 

4 min read - Everybody in tech is talking about ChatGPT, the AI-based chatbot from Open AI that writes convincing prose and usable code. The trouble is malicious cyber attackers can use generative AI tools like ChatGPT to craft convincing prose and usable code just like everybody else. How does this powerful new category of tools affect the ability of criminals to launch cyberattacks, including social engineering attacks? When Every Social Engineering Attack Uses Perfect English ChatGPT is a public tool based on a…

4 min read

How I Got Started: White Hat Hacker

3 min read - White hat hackers serve as a crucial line of cyber defense, working to identify and mitigate potential threats before malicious actors can exploit them. These ethical hackers harness their skills to assess the security of networks and systems, ultimately helping organizations bolster their digital defenses. But what drives someone to pursue a career as a white hat hacker, and how do you get started in leveraging so-called “evil” skills for the greater good?? In this exclusive Q&A, we spoke with…

3 min read