The IT Nerd

ZScaler researchers have revealed that an undisclosed victim paid a record $75 million ransom to the Dark Angels ransomware group earlier this year. This figure nearly doubles the previous highest ransom of $40 million, paid by CNA Financial in 2021.

The Dark Angels group, reportedly a rebranded version of the Babuk ransomware family, first emerged in May 2022. The group’s most notorious attack occurred in September 2023, targeting Johnson Controls, an automation and manufacturing company. SentinelOne reported that the attackers “used Dark Angels ransomware to lock the company’s VMWare ESXi servers” and demanded $51 million, though it remains unclear if the ransom was paid.

Steve Hahn, Executive VP, BullWall had this to say:

“Unlike other forms of cyber attacks, Ransomware has ties to Russia in virtually all instances. Whether it’s Russian based groups or Russia based tools or hacking services, nearly every attack has deep Russian ties. The proxy war we are engaged in via Ukraine has amped up Russia’s attacks on “soft targets” in the US that will do the most damage, along with getting the most ransom. Out of control inflation in the US over the last 4 years can be amplified by attacks on the supply chain or production. This, along with the fact that manufacturing can be slightly behind on their security journey, makes them a very easy and obvious target. 

Virtually all Ransomware attacks include a double extortion technique. The threat actors will encrypt the data and steal the data. You’ll pay to decrypt (to get your data back) and you’ll pay again to not have them leak embarrassing information or sell your secrets on the dark web. In addition, virtually all Ransomware attacks are preceded by a command and control element. Threat actors slowly get in to the Network, then use special tools like Cobalt Strike to get admin credentials, with admin credentials they can do whatever they desire. Including encrypting your backup or disabling your security products. 

All of these groups are connected to Russian Hackers. The groups and affiliations merge and morph. They use different encryption payloads but most are nearly undetectable by modern EDRs if they can launch them in the customers environment.

Total Ransomware payments have exploded to over a billion dollars a year, in just known payments, the number of successful attacks has more than doubled in the last 2 years and the average payment has gone up from $850,000 to over $2M in 2024. 

Organizations need defense in depth. Layers and layers of security. They also need to focus on not just preventing Ransomware, but also containment and recovery. They need to treat a successful Ransomware attack as a “when” not “if” scenario and plan accordingly. Table stakes is also MFA, Microsgementation and Zero Trust. But these are silver bullets. They still need to figure out how they react and respond quickly when that event occurs. 

Zero Trust is important. It will certainly lessen the chances of an attack. But this journey is typically very long for customers and still not a silver bullet. Zero day attacks, Shadow IT, personal devices, IoT devices, these are all attack vectors for Ransomware and once the encryption begins at the shares drives, whether those are cloud or local, it’s only a matter of time before all of the data is encrypted, even with zero trust network architecture in place. 

And of course, AI will increase the volume of phishing attacks and allow each and every email a custom look. AI tools can search all public information about their “target”, LinkedIn, Yelp, Facebook, Venmo payments. Anything public to find recipients to interact with and form a custom phishing email to the user. This means the number of highly targeted attacks will explode in the coming years. Along with that, AI can create Ransomware variants in milliseconds that will appear to EDR and antivirus as something they’ve never seen, making it incredibly difficult for them to stop those attacks. Along with that, dark web brokers are connecting people with footholds and access in companies to those with the payloads. The Facebook Marketplace for hackers.”

There’s a lot to unpack from Mr. Hahn, but it is very much worth reading. Organizations need to be prepared for all eventualities. As in keeping the bad guys out, and what to do if they get in. And most importantly, they should never, ever pay up as that simply encourages these threat actors. Frankly, your best defence is to do everything possible to not be a victim.