Why Can't the U.S. Stop Ransomware Attacks?

TL;DR

The U.S. cannot stop ransomware attacks easily because they are notoriously difficult to attribute and many groups operate freely from Russia or former Soviet states without political cooperation. Ransomware can shut down critical infrastructure, typically entering through phishing emails or unsecured network connections before encrypting files. Victims paid nearly $350 million in cryptocurrency in 2020, a 311% annual increase. Read on to understand the attackers’ methods, payments, and enforcement obstacles.

Transcript

Unknown: This is probably the most significant ransomware attack on one of our critical infrastructures ever. Colonial Pipeline is the operative largest pipeline Last month, hackers took our gasoline hostage now they're carrying fuel from the Gulf Coast to the northeast, it was hit with a ransomware attack. attacking our meat supply. JBS says units... Read More

Key Insights

• Ransomware is a program hackers use to hold digital information hostage, and it has become the top choice of malware for criminals, entering via phishing emails or unsecured network connections and encrypting victims' files to block access.
• The total ransom paid by victims in 2020 reached nearly $350 million worth of cryptocurrency, a 311% increase compared with the previous year, showing how rapidly the criminal industry expanded.
• Double extortion became a new trend at the start of 2020, where attackers not only encrypt data but also steal it and threaten to leak or post it if the ransom isn't paid, driving demands higher.
• Bitcoin accounted for 98% of ransomware payments in the first quarter of 2019, though U.S. officials later seized $2.3 million in Bitcoin paid to the hacker group Darkside after the Colonial Pipeline attack.
• Ransom payments concentrate among few criminals: a study found 199 deposit addresses received 80% of all funds in 2020, and just 25 addresses accounted for nearly half.
• Attribution is the core obstacle, as many groups operate freely within Russia or former Soviet states as long as they don't hit targets in that country, so without political cooperation the threat won't fade.
• Recovery often costs more than the ransom itself, with the average cost of recovery ballooning to $1.85 million in 2021, roughly 10 times bigger than the size of the actual ransom payments.
• Federal law does not directly address ransomware; it falls under broad cybercrime statutes like the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act, while Congress focuses on funding state and local governments.

Questions & Answers

Q: Why can't the U.S. stop ransomware attacks?

Cyberattacks are notoriously difficult to attribute, so attackers often face few consequences. Many ransomware organizations operate freely within Russia or other former Soviet states as long as they avoid local targets, and the threat is unlikely to disappear without political cooperation.

Q: What is ransomware and how does it work?

Ransomware is a program hackers use to hold digital information hostage. It commonly enters through a phishing email or an unsecured network connection, encrypts the victim’s files, and demands payment in exchange for a decryption key.

Q: How much did ransomware victims pay in 2020?

Victims paid nearly $350 million in cryptocurrency during 2020. That represented a 311% increase from the previous year, while the estimated total cost of ransomware reached about $20 billion in 2020.

Q: What is double extortion in a ransomware attack?

Double extortion occurs when attackers both encrypt data and steal it. They then threaten to publish or leak the stolen information unless the victim pays, forcing the victim to consider both restoring access and preventing disclosure.

Q: How are ransomware payments negotiated and paid?

Negotiations can occur through a dark-web chat room reached with a unique identifier in the digital ransom note. If the victim agrees to pay, the negotiated amount is transferred in cryptocurrency and the criminals send a decryption key.

Q: Why is Bitcoin commonly used for ransomware payments?

Bitcoin was the most popular payment choice, accounting for 98% of ransomware payments in the first quarter of 2019. Cryptocurrency payments are not necessarily beyond recovery: U.S. officials seized $2.3 million in Bitcoin paid to Darkside after the Colonial Pipeline attack.

Q: How concentrated are ransomware payments among criminals?

A relatively small number of criminals receive most ransomware funds. A study found that 199 deposit addresses received 80% of all funds in 2020, while only 25 addresses accounted for nearly half.

Q: Why can ransomware cause more damage than the ransom itself?

Ransomware can completely disrupt a business or critical infrastructure, as illustrated by the Colonial Pipeline attack. The average recovery cost reached $1.85 million in 2021, roughly 10 times the actual ransom payments, because victims must restore systems and investigate what attackers accessed.

Summary & Key Takeaways

• Ransomware, which hackers use to hold digital information hostage, has become criminals' top malware choice. It usually enters through a phishing email or unsecured network connection, then encrypts the victim's files and demands a ransom for a decryption key, disrupting enterprises and infrastructure like the Colonial Pipeline.

• The industry has exploded financially: victims paid nearly $350 million in cryptocurrency in 2020, a 311% rise from the prior year. Barron's estimated ransomware's total cost at about $11.5 billion in 2019 and around $20 billion in 2020, while recovery averaged $1.85 million in 2021.

• Fighting back is hard because attacks are notoriously difficult to attribute and many organized groups like Evil Corp and Darkside operate freely from Russia or former Soviet states. Paying is illegal if attackers are under U.S. sanctions, and Biden signed an executive order after Colonial Pipeline.