Chainalysis: ransomware attacks are constantly growing for hackers

According to Chainalysis, ransomware hackers are becoming more dangerous and sophisticated, and the ransomware in cryptocurrencies they receive from victims for decrypting files is on the rise.

Analyst firm Chainalysis reported that addresses linked to ransomware received at least $ 81 million in cryptocurrency this year, up from $ 406 million for all of 2020. Analysts suspect the real losses from extortion are much higher. Criminals constantly create new addresses, and attacked companies often hide their extortion attempts.

Chainalysis said the prevalence of ransomware as a service (RaaS) is driving the explosive growth of corporate cyberattacks. Under RaaS, ransomware developers essentially license their versions of the software and share the profits with affiliates. According to the researchers, the DarkSide hacker group received the bulk of its revenue through RaaS in the first quarter of this year.

Ransom payments paid to hackers are also steadily increasing. Ransomware victims paid an average of $ 54,000 in the first quarter of this year, up from $ 46,000 in the fourth quarter of 2020 and $ 12,000 in the fourth quarter of 2019. Typically, at least one $ 10 million ransom is paid per quarter.

Cryptocurrencies, especially BTC, where ransom payments are most often paid, are tracked through public blockchains, allowing Chainalysis to track the movement of money. About 9% of the cryptocurrencies at hacker-owned addresses in the last quarter were distributed to fraudulent stores, hacker tool service providers, and professional negotiators.

But most of the cryptocurrencies received by hackers last quarter – more than 75% – ended up on cryptocurrency exchanges. That being said, the vast majority of versions of ransomware are likely distributed by cybercriminals linked to Russia. Analysts at Chainalysis believe that these cybercriminals will account for a “large share” of ransomware activity in 2021.

According to Chainalysis, the most lucrative versions of 2021 ransomware viruses are hard-coded to avoid casualties among Russian-speaking users. Russia-related hackers are estimated to have generated about 92% of the ransom revenue this year, up from 86% last year.

A few days ago, the operator of the largest fuel pipeline system in the United States, Colonial Pipeline, paid hackers a ransom of $ 5 million in cryptocurrency to restore the operation of the system, a failure in which led to a shortage of fuel. Law enforcement agencies began to actively prosecute hackers who distribute ransomware. Recently, BleepingComputer reported that US law enforcement officers have seized servers belonging to the DarkSide hacker group.