Another day, another malware scare - but this time it’s different. Although the concept of ransomware has been around for several years, there’s been a sea change of late, leading to something of a ‘perfect storm’ for UK businesses.
The basic premise of a ransomware attack is a fairly simple one. After becoming infected by malware by clicking a link or downloading and opening a file, the unsuspecting user finds that they are unable to boot their programs, or access their files. A ransom note informs them that their files are now encrypted and a payment is required to release them. Meanwhile, the ransomware has spread throughout the enterprise network, encrypting as it goes. The result can be devastating for any business.
Scale of the threat
The sheer scale of the ransomware threat has grown to epic proportions in recent months. A regular IT security report into global malware by volume has found a ransomware variant (called Locky) in the top three for the first time in September 2016, and a 13% increase in ransomware attacks month-on-month. Our own research at Datto found that 91% of IT services providers have seen clients victimised by ransomware.
Although modern ransomware dates back to 2013, when a variant known as ‘Cryptolocker’ made the headlines, the technical landscape has changed. Crypto ransomware is no longer just an annoyance; it’s a highly persistent and organized criminal activity. This is a core reason for this enormous rise in volume; ransomware is now serious business. For example, the codebase for the ransomware strain Locky has received a string of updates over recent months, and is now being spread - via spam - through the massive Necurs botnet, which is thought to comprise more than 6 million compromised devices, or ‘bots’. This fact alone has pushed spam levels to their highest volumes since mid-2010.
As well as rising volume, there’s increasing focus - an independent survey found that the high-value financial district of London is under particularly intensive attack, with 10,500 ransomware attacks in the Square Mile in the last year alone - a figure that is 670% greater than that in the next biggest hit area: Manchester.[1]
The impact
Malware has always been a numbers game, and that rise in volume is having just the effect the criminals intend. Researchers found recently that nearly half (44%) of UK IT decision makers surveyed said they’d been infected with ransomware at least once over the past 24 months, with 27% having been hit more than once. Although two thirds (65%) of respondents said they paid the ransom, one in five organisations didn’t get their data back.[2]
The technical sophistication of the malware has been drastically improved, a far cry from early variants which made basic cryptographic errors, such as sharing private keys between different families, or hiding the key in the exploit code itself. These errors meant that security researchers and anti-virus software vendors were able to successfully develop fixes for many of these early examples. Unfortunately, these loopholes have often been closed in more recent versions, as malware developers have received more investment. According to Reuters, Ransomware netted criminals more than £196 million in 2015, and made more than £171 million in just the first quarter of 2016, so it’s not hard to understand why the quality of the code has improved in step.
Of course, the final part of the ransomware puzzle for the criminals is collecting the ransom payment, and that area has also seen concerning developments. Post-infection, businesses can now expect a unique reference number to use when messaging the helpdesk, which will often be manned round the clock, sometimes with phone as well as messaging support. Non-technically savvy victims will be supplied with detailed ‘How-to’ presentations so they can setup and manage Bitcoin wallets, for example. The focus on gaining a good ‘conversion rate’ of infected systems to payments is absolute.
SMB’s are particularly at risk from ransomware for two reasons - an increasing lack of tolerance for downtime, which can seriously damage a smaller business, and the lower likelihood of preparations being in place to mitigate. A recent study by IDC found that Network downtime costs 80% of small and medium-sized businesses (SMBs) at least £11,500 per hour, and for 20% of SMBs one hour of downtime can cost £58,400.
Ransomware poses a serious threat to businesses of any scale, but particularly SMBs. On the positive side, the best mitigation steps apply to everyone, and if correctly undertaken will have positive effects far beyond ransomware. However, the potential for this threat to change the way businesses operate online is considerable, and is only going to rise.
The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.
