Ransom demands surged 45% in 2021 - New study finds

New research conducted by security vendor Group-IB revealed that the average ransom demand in 2021 was $247,000, 45% more than the previous year, with most threat actors trying to force payment via double extortion tactics.

 

The report titled "Ransomware Uncovered 2021/2022" was compiled from an analysis of over 700 investigations undertaken by the security vendor’s incident response team.

 

According to the researchers, the continued rise of ransomware can be attributed to the proliferation of initial access brokers and ransomware-as-a-service offerings on the dark web. According to the researchers, more sophisticated threats made it more difficult for victims to recover.

 

The average downtime from an attack increased from 18 to 22 days yearly. On the plus side, the researchers discovered that attacker dwell time decreased from 13 days to nine days during the same period. This restricts threat actors’ ability to move laterally within networks, steal data, and deploy ransomware payloads.

 

According to the researchers, data theft and threatened leakage were used in 63 percent of attacks last year to force payment. Lockbit, Conti, and Pysa were the most aggressive in leaking data.

 

However, it was two newcomers, Hive and Grief, who piqued the researchers’ interest, propelling them into the top ten list of ransomware gangs based on the number of victims posted to leak sites. The researchers noted that remote desktop protocol (RDP) remains the top vector for attacks (47%), followed by phishing (26%). More attacks were facilitated by exploits of public-facing applications last year (21%) than in 2020 (17%).