Cyber Defense Magazine Special Annual Edition for RSA Conference 2021

Ransomware is on the rise, and it’s not slowing down.
Cryptoloc founder and chairman Jamie Wilson explains
the perfect storm of conditions that have combined to
allow ransomware to run rampant – and how
organizations can protect themselves.
For most of the world, the past 12 months have been defined by COVID-
19. But for cybersecurity professionals, it’s the rise of ransomware that has
set off alarm bells. Of course, these two scourges are not mutually
exclusive.
Now, there’s nothing particularly new or novel about the concept of
ransomware – the practice of locking a victim out of their own files and
demanding a ransom for their decryption dates back to at least the mid-
2000s. What is deeply concerning, however, is how frequent and impactful
these cyberattacks have become.
Ransomware on the rise
Ransomware attacks dealt unprecedented damage to organizations in 2020. The FBI reported a 400 per
cent increase in cyberattacks after the onset of COVID-19, while a report into the economic impact of
cybercrime by McAfee and the Centre for Strategic and International Studies (CSIS) found that company
losses due to cyberattacks had reached almost $1 trillion in the United States alone by late 2020.
Whereas a typical ransomware attack against an individual may once have netted the attacker a few
hundred dollars, increasingly savvy cybercriminals now target organizations, extracting hundreds of
thousands of dollars from each ‘successful’ attack and helping to drive small and medium-sized
enterprises out of business.
One attack in 2020 against German IT company Software AG came with a staggering $20 million ransom
demand. Another German attack took a terrible toll in September, when a woman in need of urgent
medical care died after being re-routed to a hospital further away while Duesseldorf University Hospital
dealt with a ransomware attack.
A report by defense think tank the Royal United Services Institute (RUSI) and cybersecurity company
BAE Systems found that the number of groups launching ransomware attacks grew month on month
throughout 2020, and that most of these groups are now utilizing a tactic known as ‘double extortion’ –
not only do they force organizations to pay a ransom to operate their systems and unlock their encrypted
files, but they also threaten to leak the data, intellectual property and other sensitive information in those
files if the ransom isn’t paid.
Cybercriminal group Maze is thought to have been the first to employ the double extortion tactic in late
2019, and it’s since been used in attacks against major companies like Travelex, CWT and Garmin.
62