After a few years of declines, ransomware attacks came back with a vengeance in 2023 according to a new report. Here’s what we know about the resurgence, why it’s happening, and what you can do to protect yourself and your business.
What We Know About a Very Bad Year
The 2024 report from NCC Group reveals a troublesome spike in ransomware attacks, up 84% from the previous year. The total number of global ransomware attacks captured in the report jumped by more than 2,000 cases from 2022 to 2023:
- 2022: an estimated 2,531 new attacks
- 2023: an estimated 4,667 new attacks
NCC points out that several new ransomware groups entered the “market” in 2023. While LockBit, a well-known ransomware group, still led the pack, new attackers notched a sizeable number of successful attacks.
Industrial companies were the hardest hit, followed by consumer cyclicals (a category that includes automotive, entertainment, and retail). Technology companies came in third.
We find this interesting because these aren’t so much the companies that make national news headlines for ransomware attacks. We tend to hear about healthcare systems and government agencies getting hit with ransomware — but this can lend a false sense of security when by far the most common targets are for-profit businesses.
Launching Ransomware Attacks Is Getting Easier Thanks to “Ransomware as a Service”
Another reason for the big jump in ransomware attacks is that they’re getting easier to run.
Thankfully we didn’t say easy — ransomware attacks are still technically complex. They’re a lot harder to pull off than a basic phishing scheme that uses a fake website to steal login credentials.
But they’re a lot easier, if you’re willing to shell out some upfront cash. We’re talking about something called “Ransomware as a Service.”
To understand what that’s supposed to mean, let’s back up.
You’ve probably heard of Software as a Service (or SaaS), which is when you subscribe to a company for access to cloud-based software. If you’re paying for Google Workspace or Microsoft 365, you’re using SaaS tools to make doing business easier. You’re paying for a shortcut, for the ability to not have to create your own software from scratch. (I’m glad I didn’t have to write the code underlying the word processor I’m using to create this post!)
Well, some enterprising bad guys have applied the same principle to ransomware. It’s now possible to buy or rent ransomware attacks — no elite coding skills required. That’s opening the doors to new waves of attacks, though thankfully this variety tends to be easier to stop since specific attack vectors don’t tend to work for all that long once discovered.
How Attackers Are Getting Through
Protecting yourself from ransomware starts with understanding how these attacks keep succeeding. There are a few different ways, but the most common one is still phishing.
It’s a tale as old as time (versions of this scam existed before the internet): you get an email or a text message or a message on social media. It looks like it’s from your bank, your boss, Microsoft, Slack, DocuSign — anywhere that sounds important. The email describes some big urgent problem you need to go fix and conveniently offers you a button to click. That button doesn’t lead you to a legit site, but to an impostor who’s trying to steal your login credentials — and more.
Sophisticated phishing attacks can end up installing malware or even ransomware itself.
Keep Your Business Safe
Keeping your business safe starts with smart internet hygiene: don’t open urgent links. Don’t reuse passwords. Set up phishing awareness training so your team knows how to spot the signs of a fake.
Education goes a long way, and tightening up your hardware and software security does, too. We can help with any of it — just reach out and we’ll take care of the rest!