{"id":20380,"date":"2021-12-21T19:43:37","date_gmt":"2021-12-21T19:43:37","guid":{"rendered":"https:\/\/www.esecurityplanet.com\/?p=20380"},"modified":"2021-12-23T18:45:45","modified_gmt":"2021-12-23T18:45:45","slug":"the-link-between-ransomware-and-cryptocurrency","status":"publish","type":"post","link":"https:\/\/www.esecurityplanet.com\/threats\/the-link-between-ransomware-and-cryptocurrency\/","title":{"rendered":"The Link Between Ransomware and Cryptocurrency"},"content":{"rendered":"

There are few guarantees in the IT industry, but one certainty is that as the world steps into 2022, ransomware<\/a> will continue to be a primary cyberthreat.<\/p>\n

The dangers from ransomware have risen sharply since WannaCry and NotPetya<\/a> hit the scene in 2017, and this year has been no different. A pair of recent reports underscores just how big that threat is.<\/p>\n

The Global Threat Landscape Report<\/a> released in August by FortiGuard, the threat intelligence<\/a> unit of Fortinet, found that the weekly average of ransomware incidents over the previous 12 months had jumped 10.7 times. In Fortinet\u2019s Global State of Ransomware Report<\/a> in September, two-thirds of companies surveyed had been victims of ransomware attacks and 85 percent said they were more concerned about ransomware than any other cyberthreat.<\/p>\n

The sharp increase in ransomware attacks can be attributed to many reasons, from the low level of cyber hygiene of some enterprises to insufficient training and education of employees<\/a> and patch management<\/a> issues, according to Derek Manky, chief of security insights and global threat alliances for Fortinet\u2019s FortiGuard Labs. Cybercriminals don\u2019t have to work too hard to get into these systems. When they do, the payoff can be huge, particularly as attackers are setting their sights on larger companies.<\/p>\n

Cryptocurrency Fuels Ransomware<\/strong><\/h2>\n

One constant in all this will be cryptocurrency, the coin of the realm when it comes to ransomware. The big payoffs, the tendency of most victims to pay the ransom demand, and the money to be made by selling or leasing their malware in the growing ransomware-as-a-service (RaaS)<\/a> market are all enticements when it comes to ransomware.<\/p>\n

The engine that is driving much of this is cryptocurrencies, which have become the way ransoms are paid and are creating the financial foundation for the rapid evolution of the ransomware market, the skyrocketing increases in incidents and the growing numbers of bad actors getting into it, Manky told eSecurity Planet<\/em>.<\/p>\n

\u201cThere is no doubt a parallel rise here that we’re seeing,\u201d he said. \u201cIt is because of the cash cow. Cryptocurrency really is fueling this in a sense. … If you were to take cryptocurrency away from that, they don’t have a convenient digital platform. They’re going to have to go back to the drawing board. It actually makes their operations more expensive because they need to try to be innovative and get more boots on the ground themselves, just like any business would if they don’t have a platform.\u201d<\/p>\n

\"ransomware
Fortinet ransomware detections<\/figcaption><\/figure>\n

Also read: The State of Blockchain Applications in Cybersecurity<\/a><\/p>\n

Crypto Enables ‘Vicious Circle’<\/strong><\/h2>\n

Compounding all this is that ransomware is a \u201cvicious circle,\u201d Manky said.<\/p>\n

\u201cOnce you have that lower state of security and attackers are getting into systems, they’re forcing the hands as a means of enterprises to pay the ransom<\/a>,\u201d he said. \u201cWhen they’re paying the ransom using cryptocurrency, it’s encouraging cybercriminals. It’s making their pockets deeper. They don’t have to do a heavy lift to reap profits like they’re doing today.”<\/p>\n

The use of cryptocurrencies like Bitcoin, Ethereum and myriad others harkens back to the days of e-gold, another digital currency launched in the 1990s that included the use of online accounts. E-gold use peaked in the mid-2000s before it was suspended in 2009 for legal reasons. As cybercrime became more about monetization, cybercriminals began leveraging the currency for money laundering, fraud and other schemes, he said.<\/p>\n

Between the demise of e-gold and the rise of cryptocurrency, bad actors used a number of different ways to move money, including gift cards. They would steal credit cards to buy gift cards and then use those to be cashed out and sold to other people, Manky said.<\/p>\n

Also read: Best Ransomware Removal Tools<\/a><\/p>\n

‘New Form of Crypto-jacking’<\/strong><\/h2>\n

The rise of cryptocurrency has had a ripple effect throughout the cybercriminal world, Mansky said. When it first hit the scene, the primary targets of threat actors were the cryptocurrency exchanges themselves. The payouts for hackers were significant; when they hit an exchange, they had access to hundreds of cryptocurrency wallets. However, exchanges began strengthening their security, which made attacking them more expensive, so cybercriminals shifted tactics and began increasingly to target users.<\/p>\n

\u201cInstead of robbing a bank, they’re going to the victims themselves,\u201d Manky said.<\/p>\n

For the past five years, there has been cryptomining<\/a>, where bad actors infect systems with malware<\/a> that leverages the CPUs to mine for coins, essentially crowdsourcing stolen CPU power. More recently has been crypto-jacking, where hackers go directly into a user\u2019s wallet and steal their coins.<\/p>\n

This also has shifted the attack vector and opened up end users to greater threats. Attackers no longer are going after one target, he said. They may get into a system to steal digital wallets, but once a system is compromised, it\u2019s open to other attacks.<\/p>\n

\u201cIt’s a new form of crypto-jacking, essentially, but these are always multi-purpose in a sense, because in order to install that malware, they need what we call a ‘loader,\u2019\u201d he said. \u201cThey need a channel into that system. They do this through taking advantage of cyber-hygiene practices, social engineering<\/a>, all those things we talk about. … But once they’ve infected these systems, they’re compromised, and oftentimes we see a lot of secondary attacks happening. It’s just more and more volume and attack angles.\u201d<\/p>\n

\"top
Fortinet: Top ransomware concerns<\/figcaption><\/figure>\n

Cybercrime Rewarded<\/strong><\/h2>\n

Cryptocurrency is enabling cybercriminals to enrich themselves beyond what had been possible. They not only can get paid more money for their actions, but the nature of the payments allows them to add more layers to their operations, making it more difficult to trace payments. It operates like cash in many ways. It makes hiding and laundering the payment easier.<\/p>\n

\u201c<\/em>They can actually print their own money,\u201d he said. \u201cThey can print cryptocurrency on a piece of paper. All it is is a big hash address, a cryptographic algorithm, and they can transfer it that way. They can transfer it on a USB stick. They can transfer it physically on a piece of paper and put it into a briefcase and give it to somebody else. Once they have that and the actual keys for it, the money’s theirs. It’s literally physically transferring a wallet to a wallet.\u201d<\/p>\n

And they have multiple coins to choose from. They can be paid in Bitcoin and wash the payment by shifting to Ethereum or other exchanges. It makes it difficult for investigators, who \u201c<\/strong>don’t have only one coin to follow,\u201d Manky said, adding that the bad actors \u201ccan fork that to 100 different alternate coins.”<\/p>\n

Also read: Best Ransomware Removal and Recovery Services<\/a><\/p>\n

More Sophisticated Cybercriminals<\/strong><\/h2>\n

The profits threat actors are reaping are helping to fuel the rise of a more sophisticated and well-armed hacker that is able to build greater expertise on the backend, so they have the capability to launch larger and more complex attacks.<\/p>\n

\u201cWe see cybercriminals now that lie between what’s typically been nation-state attacks and nation-state capability in terms of sophistication \u2013 like zero-days<\/a> and these sorts of things \u2013 that\u2019s now in the realm of cybercriminals, too,\u201d he said.<\/p>\n

More money begets more sophisticated operations and methods \u2013 think ransomware-as-a-service (RaaS) \u2013 and that leads to not only more sophisticated campaigns but also more attackers. With RaaS offered by highly sophisticated groups, less skilled people can leverage such services to launch attacks.<\/p>\n

All these cryptocurrency-fueled trends \u2013 including the greater sophistication of cybercriminals driven by massive profits, the promise of payoffs and the expanding numbers of threat actors who can launch attacks \u2013 has helped fuel the growing global problem of ransomware.<\/p>\n

Breaking the Crypto Link<\/strong><\/h2>\n

U.S. lawmakers, who this year have become more involved in the problem of ransomware as critical infrastructure \u2013 including energy systems as seen in the attack on Colonial Pipeline<\/a> and food supplies via the campaign as global meat processor JBS \u2013 also are seeing the link between ransomware and cryptocurrency<\/a>.<\/p>\n

In October, several senators and representatives sent a letter<\/a> to the departments of Justice, State and Homeland Security urging them to address \u2013 among other things \u2013 the role of cryptocurrencies in the rise of ransomware attacks, noting the anonymity the digital currencies give attackers.<\/p>\n

It\u2019s important for enterprises to understand that link as well, Manky said. A key is prevention<\/a> and protections \u2013 like backing up data \u2013 because once ransomware is in a system, they are forcing many companies that have few other options to pay in cryptocurrency. The exchanges put in protective measures, which drove up the cost to cybercriminals of attacking the exchanges. Given the increasingly distributed nature of IT, it\u2019s important for enterprises to think about prevention and resiliency in a similar way.<\/p>\n

\u201cIf we don’t do that … it’s going to be very bleak,\u201d Manky said. \u201cIt’s going to continue to fund these cybercriminals. Their pockets are going to get deeper. Their capabilities are going to become more sophisticated. They have businesses of their own and like any business, as it grows, they add more and more people, more partners. In the \u201990s, it used to be one person. Then it was a handful of people. Now we’re seeing 50, 100 people with partners, even thousands in some of these organizations. That’s a big problem.\u201d<\/p>\n

Further reading: Best Backup Solutions for Ransomware Protection<\/a><\/p>\n\n\n

\n \n\n \n\n
\n \n <\/path>\n <\/svg>\n <\/div>\n \n
\n
\n

\n Get the Free Cybersecurity Newsletter <\/h3>\n \n \n

\n Strengthen your organization's IT security defenses by keeping up to date on the latest cybersecurity news, solutions, and best practices. Delivered every Monday, Tuesday and Thursday <\/p>\n <\/div>\n\n

\n
\n \n Email Address\n <\/label>\n \n <\/div>\n\n
\n
\n \n \n By signing up to receive our newsletter, you agree to our Terms of Use and Privacy Policy. You can unsubscribe at any time. <\/label>\n <\/div>\n <\/div>\n \n