Ransomware is an expensive cybercrime and getting more so all the time. Payouts have risen massively in the past few years. But while ransomware payment amounts make headlines, the real costs go far beyond what’s paid to the attackers.

How Ransomware Works Now

Ransomware has always been a problem. But in recent years, attackers have gotten really good at it.

Your typical ransomware attacks involve the infection of multiple devices. It spreads via malware that compromises the system. Once inside, attackers exfiltrate as much data as possible before encrypting it and displaying a ransom note demanding payment in cryptocurrency. They threaten to keep the files and/or publicly release the stolen copies.

The rise of ransomware goes hand-in-hand with the rise of criminal ransomware-as-a-service (RaaS) businesses, which specialize in attacks on behalf of their clients. These RaaS gangs model their service after SaaS businesses, offering tech support, working with a network of freelance attackers and malware developers. They learn, improve and establish ransomware ‘best practices’. This more serious approach to ransomware makes it much more effective. This, in turn, drives up the cost of cyber insurance.

What makes the new ransomware gangs so harmful are the following elements:

  1. Viral malware
  2. The one-two punch of data theft plus encryption
  3. Cryptocurrency payment
  4. RaaS.

A high-quality backup regime used to be the best defense against ransomware. But now that attackers also threaten public disclosure of files, it’s only half a defense. You also need a more thorough defense against the malware itself.

Defense is key. Because the real cost of ransomware goes way beyond any ransom you might pay.

What Happens After the Attack?

Repair costs in the United States are now climbing into the millions. But as painful as the payment is, that’s just the beginning.

Restoring backups is another small step. The big problems include having to discover and fix the vulnerabilities that enabled the breach in the first place. You have to purge the malware, which means installing or imaging operating systems again. Your team also needs to re-install applications and restore data. Much of this will happen remotely and will be limited by available bandwidth. The restoration process itself can take days, during which no actual work can be done; customers can’t be served and orders can’t be taken.

The Real Costs of Ransomware

Beyond paying the ransom (which you should try to avoid), the costs of ransomware include:

Loss of revenue: The forced downtime during and after an attack can exact financial costs that are many times higher than the ransom itself. Ransomware attacks typically take companies out of commission for a few days. Intermedia says 32% of victims go 5 days or longer without access to their files.

Brand reputation: News of a ransomware attack can make customers associate your brand with a perceived failure to safeguard data, including customer data. Customer loyalty may migrate during this period to competitors. And the damage to reputation can last for years.

Business reputation: Partners, investors, shareholders, financial services, customers and other stakeholders look on during an attack. Therefore, overall business reputation could cause harm for years into the future.

Loss of leadership talent: This damage to your reputation can motivate leaders within your organization to distance themselves by finding work elsewhere.

Legal liability: Ransomware attacks can be followed by lawsuits from clients and others who claim negligence, privacy violations and other transgressions.

Data loss: Paying isn’t always a solution, in many cases. Sometimes the attackers implement such shoddy encryption that the files cannot be encrypted, or they simply don’t deliver on the promise to decrypt. As one example, researchers found the Ryuk family of ransomware attacks tend to result in data loss and faulty backups because the attackers use low-quality software which doesn’t always work. Even with backups, ransom payouts and keys to unlock files, it’s very unlikely that the victim will be able to restore or recover 100% of the data.

Loss of the entire business: The sum total of damage from ransomware can actually end some businesses completely. The downtime, loss of customers, damage to reputation and lawsuits can make running the business impossible.

The bottom line is that ransomware sounds bad, but in reality, is even more complex than it sounds. Make sure you’re protecting yourself.

More from Advanced Threats

Black Hat 2022 Sneak Peek: How to Build a Threat Hunting Program

You may recall my previous blog post about how our X-Force veteran threat hunter Neil Wyler (a.k.a “Grifter”) discovered nation-state attackers exfiltrating unencrypted, personally identifiable information (PII) from a company’s network, unbeknownst to the security team. The post highlighted why threat hunting should be a baseline activity in any environment. Before you can embark on a threat hunting exercise, however, it’s important to understand how to build, implement and mature a repeatable, internal threat hunting program. What are the components…

Top-Ranking Banking Trojan Ramnit Out to Steal Payment Card Data

Shopping online is an increasingly popular endeavor, and it has accelerated since the COVID-19 pandemic. Online sales during the 2021 holiday season rose nearly 9% to a record $204.5 billion. Mastercard says that shopping jumped 8.5% this year compared to 2020 and 61.4% compared to pre-pandemic levels. Cyber criminals are not missing this trend. The Ramnit Trojan, in particular, is out for a shopping spree that’s designed to take over people’s online accounts and steal their payment card data. IBM…

Detections That Can Help You Identify Ransomware

One of the benefits of being part of a global research-driven incident response firm like X-Force Incidence Response (IR) is that the team has the ability to take a step back and analyze incidents, identifying trends and commonalities that span geographies, industries and affiliations. Leveraging that access and knowledge against the ransomware threat has revealed tools, techniques and procedures that can often be detected through the default Windows event logs (WELs). In particular, the X-Force IR team has identified several…

How to Report Scam Calls and Phishing Attacks

With incidents such as the Colonial Pipeline infection and the Kaseya supply chain attack making so many headlines these days, it can be easy to forget that malicious actors are still preying on individual users. They're not using ransomware to do that so much anymore, though. Not since the rise of big game hunting, anyway. This term marks ransomware actors' shift away from attacks against individual users and towards operations targeting large enterprises, noted CNBC. But attacks like phishing and…