Ransomware is a cybersecurity crisis-and conundrum-that has yet to be solved. The stakes are high and consumer trust hangs in the balance. For those subjected to ransoms, the message is clear: if you want your business back, pay. In recent years, ransomware attacks have skyrocketed, causing billions of dollars in damages. Let’s look at the good news-and the bad news-about ransomware trends in 2022-2023.
The Good News
Criminals Steal Less Money
Blockchains show that ransomware payments decreased by 40% in 2022 compared to 2021, dropping from $766 million to $457 million. However, the decline is not due to fewer attacks, instead, victims are refusing to pay criminals. Coveware negotiates for insurers and has statistics on payment. In 2019, 76% of victims paid and the trend has been declining since. In 2020 70%, in 2021 50%, and in 2022, only 41% paid. In some cases, victims cannot pay because North Carolina and Florida prohibit state agencies and local government entities from paying ransoms. Similar bills were proposed but died in Pennsylvania and New York. In some cases, the federal government makes payments by victims or insurers illegal by listing several ransomware criminals on its Office of Foreign Assets Control (OFAC) advisory.
Criminals Apprehended or Turned
In 2022-2023, several ransomware criminals were apprehended or turned. Some highlights:
- Leading criminal ransomware gangs split their allegiances between Russia and Ukraine, turning on each other.
- Sodinokibi/REvil ransomware defendant was extradited to the United States and arraigned in Texas.
- A doctor designed software with a “Doomsday Counter,” shared in profits from ransomware attacks, and bragged about by an Iranian state-sponsored hacking group.
- The Justice Department seized and forfeited approximately $500,000 from North Korean ransomware actors and their conspirators.
- The US Department of Justice disrupted the Hive ransomware variant, preventing victims from having to pay $130 million in ransom demand. This malware had previously targeted 1,500 victims and extorted $100 million in ransoms.
The Bad News
Ransomware Is Still a Scourge
Despite the good news, ransomware is still a major threat. In January 2023, there were 33 publicly disclosed ransomware attacks, the highest number of attacks ever recorded for a January. Notable victims were the NY Bar, which lost 1.8 terabytes of data, the UK Royal Mail, and 11 education institutions. In February 2023, there were 40 ransomware attacks, a 21% increase over January. Notable victims include the Dish Network, which was taken offline, the US Marshal Service, and the City of Oakland.
Ransomware Is Attacking Virtualization
Ransomware is also attacking virtualization. Criminals first compromise credentials to access vCenter Server. Then they turn on the ESXi Shell, and secure access via SSH. Several mitigation methods exist. They include segmenting the network to isolate the management of ESXi and vCenter on a subnet or VLAN; turning on lockdown mode, configuring the ESXi host firewall to restrict access to IPs or subnets; not using an active directory but rather using vCenter Single Sign-On and using immutable backups.
Next, let’s look at a few platform attacks and mitigation methods:
VMware, vSphere, and ESXi platforms –
- Step one: Criminals compromise credentials to access vCenter Server
- Step two: Attackers turn on the ESXi Shell and secure access via SSH (TCP/22)
- Mitigation step one: Segment network to isolate management of ESXi and vCenter on subnet or VLAN
- Mitigation step two: Turn on lockdown mode and configure the ESXi host firewall to restrict access to IP’s or subnets
- Mitigation step three: Do not use active directory; instead, use vCenter Single Sign-On. Move administrators to separate and dedicated accounts. Require MFA. Implement a PAM
An attack in February using ESXiArgs ransomware strain –
- ESXiArgs ransomware strain exploits weak patching by using a 2-year-old remote code execution (RCE) vulnerability (CVE-2021-21974)
- The perpetrator is unknown, but the impact is widespread. VMware confirms thousands of compromised servers in Canada, France, Finland, Germany, Taiwan, and the US. And last week, the FBI put the number of compromised servers worldwide at 3,800
- Prevention step one: Do not run EOGS or EOL VMware products
- Prevention step two: Disable the OpenSLP service in ESXi
- Recovery: CISA released a recovery script for victims of ESXiArgs ransomware, but the criminals countered it one day later
Ransomware Is Likely to Remain a Threat
North Korea continues to fund itself with ransomware, hence a slew of advisories has been sent out by U.S. agencies including the NSA and FBI, and by South Korean intelligence services. Russia has launched 16 different types of ransomware and wiperware directed at Ukraine, some of which are proliferating globally. On March 2, 2023, the White House released a cybersecurity strategy that flags ransomware as a major threat and “strongly discourages the payment of ransoms.” It promises to continue attacking ransomware gangs in Russia, North Korea, and Iran because “the cyber operations of criminal syndicates now represent a threat to the national security, public safety, and economic prosperity of the United States and its allies and partners”… because “total economic losses from ransomware attacks continue to climb, reaching billions of U.S. dollars annually.”
The Insurance Response
Changes in Price, Coverage, and Standards
Defense in depth requires investments in the whole security stack: avoid, prevent, mitigate, and transfer. However, the movement to SaaS and PaaS leaves your business in the hands of providers who neither indemnify nor add you to their insurance. Hence firms must insure not only their own risks but also those caused by IT supply chains. Chief among these perils are data breaches and interruptions, such as ransomware. Over the last two years, ransomware has moved large losses from insureds to insurers leading to unsurprising responses.
- First, insurers raised their rates. Premiums went up precipitously. Small firms saw 36% increases, but large firms saw 100%-200% increases. The pricing situation has changed for the better since June. Some insurers are still seeking rate increases. Travelers is seeking 20-40% increases this year. Others corrected enough last year to moderate their demands this year for more premium. So, we are seeing some flat to -5% renewals in the MM with SMEs at 5-10% increases.
- Second, coverage quality continues to deteriorate. For the last two years, almost all insurers are sub-limiting many first-party agreements: dependent business interruption and system failure, reputational-income protection, and bricking. Many have reduced or removed cybercrimes. Some have asked for more premium, while others have increased the time retention or excluded coverage altogether.
- Third, underwriters have increased underwriting standards and are demanding security controls that many SME and MM clients do not have in place. Multi-factor Authentication (MFA) is now a standard requirement, for instance. Encryption, multiple backups, and endpoint defense are also among the proliferating list of compliance measures required by today’s underwriters.
Conclusion
Ransomware remains a grave threat to businesses, non-profits, and governments worldwide. While there have been some successes in apprehending and turning criminals, ransomware attacks continue to increase. One of the most important protections to have is insurance, but the placement of insurance requires a great deal of expertise. Premiums are up, coverage is down, and compliance measures are increasingly stringent.
To avoid this trifecta of pitfalls, businesses need brokers who know the perils, protections, and products and how to prepare them in advance of underwriting. Brokers should also have expertise in developing new coverage or manuscripting cyber policies, can help insured negotiate the best contractual transfers with partners, and are expert at ground-up analyses regarding limit adequacy. Ultimately, by being able to navigate the changing insurance landscape, firms can protect themselves from the financial and reputational damage that ransomware can cause.
##
About the Author
Arturo Perez-Reyes is a Senior Vice President and Lead Cyber Strategist at Newfront. He has 22 years of experience as a risk consultant and broker helping firms identify, quantify, and transfer the liability and losses from technology, professional services, value chains, intellectual property, regulatory compliance, as well as privacy and security.
