Fact or Fallacy: Ransomware Targets Underfunded, Vulnerable Agency Networks

Fallacy: Paying Ransom Guarantees the Return of Data

According to a Sophos poll of 5,400 IT decision-makers around the world, only 8 percent of ­ransomware victims got all their data back after paying the ransom. Almost a third (29 ­percent) recovered no more than half of their data. Meanwhile, the cost of remediation — from business downtime, lost orders and operational expenses, among other damage — jumped from an average of $761,106 in 2020 to $1.85 million in 2021. 

It’s 10 times more expensive for agencies to remediate an attack than to pay the ransom. That’s why the number of ­businesses choosing to pay skyrocketed from 26 percent in 2020 to 32 ­percent in 2021. The highest ransom payment reported was $3.2 million; the average was approximately $170,000.

EXPLORE: What are the risk preparedness lessons government can take from the Oldsmar hack? 

Fallacy: Backups Make Ransomware Recovery Easy

There is a common ­misconception that recovering from a ­ransomware attack is easy if an agency has backups. The reality is that ­backups can be difficult to restore if they are ­damaged or encrypted by hackers. 

Additionally, backups don’t address secondary forms of ­disruption. Resolving a ransomware attack isn’t simply about restoring files because that doesn’t fix the vulnerabilities that made the breach possible in the first place. Governments must know how hackers penetrated the network and whether they still have access.

Fact: Attackers Launch Ransomware Through Phishing

The shift to remote work during COVID-19 created a new target for cybercriminals: employees using unsecured personal devices on enterprise ­networks. As agencies quickly moved to work-from-home environments, some security controls were overlooked. Financial services and insurance executives became key targets for ransomware and ­fraudulent email messages (known as phishing) in the past year, according to Verizon’s 2021 data breach report.

Researchers at Proofpoint also saw a rise in ransomware attacks distributed by email last year. A newer attack, identified as Avaddon, targeted U.S. organizations specifically. It circulated in more than 1 million messages, sent to manufacturing, ­education, media and entertainment ­companies. 

Avaddon is an example of Ransomware as a Service, in which someone pays to use ­ransomware instead of building it themselves.

DIVE DEEPER: New forms of ransomware could target state and local governments.

Fact: Ransomware Is Typically Built Around Known Vulnerabilities

Ransomware attacks ­usually take place when a person inside an agency clicks on what looks like a legitimate attachment, which then downloads a malicious payload and encrypts data. Many of these attacks occur via email.

Yet, larger ransomware attacks are almost always built around known vulnerabilities that give hackers access to enterprise ­networks through remote logins and internet-facing servers. Hackers exploit these vulnerabilities and try to encrypt as much of the network as possible.

RiskSense identified more than 220 IT security vulnerabilities in the Common Vulnerabilities and Exposures database tied to attacks involving r­ansomware in 2020. The number of vulnerabilities has increased fourfold since 2019.

Fact: Cities and Utilities Are Prime Ransomware Targets

Cities and utilities are increasingly becoming attractive targets for ­ransomware because of the immediate real-world consequences. They ­provide critical services but often use outdated IT infrastructure, which has more vulnerabilities. According to BlackFog’s “State of Ransomware in 2021” report, there were 23 attacks in February 2021 alone, up from 16 in the same month of 2020. 

Tulsa, Okla., is dealing with a ­ransomware attack that happened in May. The city’s IT department received notice that some of its servers were ­communicating with a known threat site. A ­ransomware attack was launched on several ­systems and moved quickly through the ­network, prompting the city’s response team to shut down all services to stop the attack. The ­incident shows that ­ransomware can affect any public or private organization, disrupting business for days or weeks.