they're happening thousands of times every day ransomware attacks are the cyber threats of our
times it seems like no one is safe from having their data encrypted by dark web
forces only to be asked to pay to get it back the share of ransomware attacks really
dramatically rose over the past years and usually by more than 100 up to 200 per year
they're making businesses poorer this is you know big money hundreds of millions of dollars
maybe even billions of dollars per year in ransom attacks and hackers much much richer
the best cyber criminals in the world like some of the young guys in st petersburg or
in other cities around the world they're making a million dollars a month we're witnessing the
industrialization of cybercrime not only is there money to be made in demanding large
ransoms from hacking victims or from selling their precious data onto third parties but there's also
a business opportunity in servicing the hackers themselves in this video we'll follow the money
how much are hackers making who is helping them and what are the costs of paying the ransom or not
i'm in the district of anhelt bitterfeld in the
german state of saxony amholt just a few weeks ago the council here fell victim
to a savage cyber attack hackers got into their computer systems and crippled them computers
yeah and
the council had fallen victim to a classic ransomware attack here's how they usually
work having chosen their victim the hacker gains access to key files on their computer
having exploited some security flaw to get in the hacker then encrypts the files meaning
the victim can no longer use them they'll then discover a ransom demand from the hacker pay up
and get your files back 2021 has seen ransomware attacks on a scale never seen before a hack on
the colonial pipeline affected fuel supplies to much of the u.s east coast another cyber
attack on software provider corsair had an impact on businesses around the world
is
technique
as i speak to you it's three weeks after the original cyber attack but the council here
still can't provide some pretty basic services for example in unhealth bitter felt you can
currently buy a car you can't drive it anywhere because you can't register it
the quickest way out of a ransomware attack is to pay the ransom usually the victim will
get access to their files back but if they don't pay well their files stay encrypted
and the hacker may even threaten to sell access to those files to someone else
so we don't know how much in ransom the hackers are demanding but the cost to the council here
of creating a whole new safe network is going to be huge but
as soon as a ransomware attack happens the victim can be sure it's going to
cost them not only is the average ransom demand estimated at 150 000 to public and private bodies
but also there's the cost of recovery and that's potentially the biggest
cost of all i mean the average ransomware attack results in 21 days of downtime for a business
the cost of that is average to over a quarter of a million dollars
hackers are aware of these extra costs to the victims and use them to their advantage when
setting the ransom they actually look at you know how much money this company makes
a month if we're shutting everything down how how much is it going to cost that organization
and what's a good price to set our ransom at that's not too high because we don't want them to
you know avoid us and not pay it and try to find other ways to to get back online but not too low
because then we're leaving money on the table the past few years have seen ransomware attacks grow
not just in number but in size and with that so of the ransoms ransomware if you think back to
2016 was an individual problem and you would have to pay a couple hundred dollars to get the key
to recover that data in 2016-2017 timeframe we started seeing threat actors emerge that
understood that if they targeted an enterprise with that same attack they could demand much
higher dollar figures so three four hundred dollars became ten fifteen twenty thousand
dollar in ransom attack that has gone up you know exponentially i think we're seeing routinely
millions and millions tens fifty a hundred million dollars even more in some cases in ransom demands
and these enormous ransom amounts are being paid colonial pipeline revealed it handed
over five million dollars to the hackers just a day after the cyber attack began
the world's biggest meat producer jbs paid 11 million to end its ransomware nightmare
victims aren't always open about whether or not they pay out but clearly enough of them
are we're certainly seeing and aware of many of these ransom payments going out because we track
the cryptocurrency wallets that these threat actors are using and we're able to identify when
there are payments being made i think it's a lot more frequently than anybody would care to
admit because these threat actors aren't going to keep doing these types of attacks
if they're not making money off of it however the ransom isn't the only way the hackers can
get money out of their victim remember they've had access to all of their precious files
they can also make money by reselling data that they gained in the attacks for example
of course private personally identifiable data or also let's say identity and access data
that will allow third parties to maliciously exploit a company server or something like that
we can't talk about the costs of cyber attacks without talking about crypto currencies
the fact is ransom payments aren't made in dollars or euros they're made with
cryptocurrencies online encrypted currencies that leave no paper trail anonymous untraceable
everything a hacker could want it's all the advantages of cash from a criminal standpoint but
with this added advantage of it being able to work across the internet you know the problem with cash
as a criminal is that it's physical and you have to move it um cryptocurrency removes that issue
for them so it's obviously a fairly attractive way to get all this done
they can effectively launder that without ever leaving their uh you know their house and then
they can also do things like jump from one chain one one blockchain to another blockchain uh so
converting it from bitcoin to monero or something like that and it becomes very hard to follow the
money so who are they well as the scale of the ransomware hacks has changed in recent years
so have the attackers large-scale cyber attacks are rarely carried out by the archetypal
individual hacker hunched over a keyboard in a dimly lit room to attack a complex organization
often takes a complex organization we see an increasing professional professionalization
of ransomware groups actually conducting these attacks so it's not only individuals
it's a criminal activity where people want to make money and there's a whole ecosystem there there's
an ecosystem of tools ecosystems of organized crime networks hacking networks tool networks uh
teams that work together around the world that's rod beckstrom once head of the national cyber
security center he spent years on the front line of the us fight against cybercrime no firmament
will simplify the world and say there's three superpowers in in hacking there's u.s russia china
they have very different models and different motivations you know if you look at the us us kind
of wants to be the uh protector of the free world so they're using their their capabilities to watch
what's going on in the world prosecute crimes press crew drug rings counter terrorism etc etc
if you look at china their goal is to become you know a super rich and prosperous middle kingdom
to be a world power russia on the other hand is lost its empire right the soviet union's gone
it may wish to regain that and in the meantime it doesn't have the same power status geopolitically
it had before and so it seeks relevance how does it become relevant yeah by being disruptive and a
great way to be disruptive is to interfere with your rivals infrastructure and their businesses
there's an important distinction to make when it comes to national governments and cyber attacks
and that's between states commissioning the hacks themselves or simply just allowing them
to be carried out from their territory there's definitely a sense of it being easier to conduct
this sort of operation in in certain parts of the world compared to others so that's not the same as
a nation-state funding this type of activity but you know in terms of its consequence it's kind of
similar the us and others have accused russia of providing a safe haven for hackers turning a
blind eye to their activities as long as russian targets are left alone the kremlin has never
confirmed nor denied it the country's surplus of computing talent and shortage of well-paid jobs
make russia a rich breeding ground for hackers when you have state-run hacking activities the
people that work for the state as employees of the government don't make nearly as much
as they can make doing criminal activities that this hacking is bad for russia because
you're teaching your best and brightest you're brilliant young people who could be building
companies and and building fruitful technologies in some cases in many cases are doing criminal
activities and that's not good often these criminal groups can rival in size their biggest
targets vast networks of hackers operating on the dark web not only carrying out the ransomware
attacks but helping others to execute them too it's known as ransomware as a service and like
its legitimate counterparts software as a service it involves the leasing out of computer programs
at a price but you won't find a download link for these ones by searching on google it handles all
of the key management it handles all of the data extortion in some cases and it also can handle
the negotiation and payment in some cases and so you can come in as a fairly novice criminal actor
just having some skills and use this ransomware as a service to basically be the back end of your
operations what we can see is that these groups become increasingly professional not only in
terms of the tools that they develop but also in terms of the let's say customer service they offer
to clients and for that that service they're taking you know 20 25 30 off the top of the
ransom demand these dark web services include a lot of the things we expect from the normal web
the wannabe hacker can get access to customer support faqs and even reviews i would argue that
ransomware operators took some cues from silicon valley and and that was actually a part of you
know what kind of inspired ransomware as a service it's not that silicon values to blame
and these criminal groups won't just offer support to the hacker who hires them they'll also offer
their services to the party who's been hacked they engage with these victims in case victims have
questions on you know how to pay or how how to regain their data or how to pay the ransom
because it's in the interest of these ransomware groups to get paid or to receive the ransoms
if you get infected with ransomware it will teach you how to sign up for a bitcoin wallet how to
you know connect your credit card to all these different things is very helpful um in that sense
like some of these these operators even have like fully serviced and actually quite good
support services the whole industry around hacking has reached a level of professionalism
that many legitimate sectors could only dream of with the cybercrime business
booming on the dark web are we losing the battle against the hackers i don't think that
either public or private companies are especially well prepared for ransomware attacks these attacks
are extremely complex and the technologies that they target are extremely complex so it's very
difficult for one organization to secure their entire networks against any kind of attack it's
about being uh you know having good hygiene being being safe but also being forward working
with threat hunting and threat intelligence to make sure that you're not waiting to be a victim
uh because if you are are hoping it's not gonna happen to you hope is not a strategy calling it
out as a business model that's deliberate because ransoms go back you know at least 500 600 years
um in in terms of written history like it's not a new idea it's just being applied in this different
framework and and that framework makes it really successful i have a law of cyber security it's
called beckstrom's law of cyber security it's 12 words anything networked can be hacked
everything is being networked everything is vulnerable and that's all from this edition of dw
business beyond if you want to know more about the money that makes the world go round check out our
playlist and while you're clicking on things why not click on like and subscribe too cheers
you