The evolution of extortion tactics in ransomware attacks – Insurance Business

Ransomware is rampant in the business world. Over the past year, ransomware attacks and related cyber insurance claims have surged in both frequency and severity. One factor driving this concerning trend is the evolution of extortion tactics.

Sophisticated threat actors are increasingly deploying additional layers of extortion beyond the initial installation of malware and data encryption, making it harder for businesses and their cyber insurers to shake off attacks unscathed.

A year ago, a ransomware claim would come in, and when we would determine that the insured had secure data backups, wed be happy because the threat actor did not encrypt that data. Our initial thinking would be: We dont have to pay a ransom because we can re-create everything from the backups, said Tamara Ashjian (pictured), Director of Claims, Tokio Marine HCC Cyber & Professional Lines Group.

But lo and behold, thats becoming irrelevant now, because even if the [threat actors] are unable to encrypt the insureds backups, theyre threatening to exfiltrate their data and post it on data leaks websites if the demand is not paid. Weve been so concentrated on the deployment of the ransomware that shuts everything down, but we started seeing this trend in the last six months where there is no encryption of data, but hackers have threatened to publish sensitive information.

Read next: The benefits of a strong cyber threat intelligence program

While ransomware attack victims can use the services of forensic investigators to monitor data leak sites and the dark web for illegally exposed data, this does not eliminate the double extortion threat. Hackers will typically show their victims a sample of the files they have exfiltrated, so the insureds know their data is in the wrong hands and theyll have to negotiate if they want to remediate any potential damages.

Ashjian commented: Now ransomware events are more dangerous because the hackers are threatening to leak sensitive information to the public, and its more likely that the insured is faced with the difficult decision of paying the ransom demand or not, even when their data is not encrypted, since there is a possibility of having their clients and/or employees information out there. Its a different way to attack, but were definitely seeing more of it.

Traditionally, one of the first lines of defense against cyberattacks of any kind was to have secure data backups stored offsite and offline. While that may mitigate the encryption component of ransomware attacks in some circumstances, it does not always prevent such attacks, and it doesnt protect against data exfiltration or resultant business interruption. One of the reasons businesses should buy cyber insurance is for financial security, Ashjian stressed, because even with the right backups, the most secure systems and the best end-point monitoring, some hackers have become so sophisticated that theyre able to penetrate into systems and do irrevocable damage, such as bankruptcy.

Beyond data encryption and exfiltration (the first two methods performed during a ransomware attack), there is also a risk of hackers initiating distributed denial-of-service (DDoS) attacks, especially if victims refuse to negotiate and pay. These DDoS attacks, which disrupt the corporate network by overwhelming it with a flood of internet traffic, would cause additional business interruption to a business thats already rallying to recover from the initial ransomware event.

Read more: Cyber insurance claims explode in severity

Weve also seen harassment of c-suite executives, where the CEO [of the victim organization] has received calls from the threat actors, and suddenly, the incident becomes very personal and the insured panics even more, Ashjian told Insurance Business. Our stance has always been: Weve hired experts, lets see what we can do. You dont want to give in right away and pay the first demand you get. But that becomes very hard for insureds to comprehend when the CEO is getting calls or theyre being threatened.

Sometimes it depends on who the insureds clientele is. If theyre a business with celebrity clients, for example, then a data leak in that instance is going to be a lot more problematic than it would be for businesses with other types of clients. That makes our job more difficult, because you really want to negotiate the best deal in a situation, but sometimes, because of the circumstances and the high potential of impending litigation, theres a lot of pressure from the insured to resolve the matter at any cost.

One thing that Ashjian has noticed is that threat actors are using more sophisticated strategies to ensure their attacks generate as much financial gain as possible. In contrast to three or four-years-ago, when many hackers made random hits without really knowing their targets, they now know exactly who theyre attacking and what information they can threaten to leak.

Another thing were noticing is, once theyre in the insureds system, theyre immediately looking for insurance policies, Ashjian added. When our experts are negotiating with them, and they take the stance of: Well, the insured cant pay that, the threat actors come back and say: Yes, they can, they have a $10 million policy. This is what were dealing with. Its become very complex, and theres something new every few weeks.

Tamara Ashjian is a Director in the Cyber & Professional Lines Group Claims Department at Tokio Marine HCC. Tamara oversees and manages the Claims team, which focuses on the handling of litigation and claims resulting from cyber and technology liability incidents.

Read more from the original source:

The evolution of extortion tactics in ransomware attacks - Insurance Business