Understanding Ransomware Using Data Science

Most ransomware victims don’t pay up — but those that do, pay fast

Non-payment is not only a viable option for victims but also the norm. After all, ransomware actors don’t profit from most of their attacks and are keenly aware that the longer ransom negotiations go on, the less likely they are to see a payout at all. To illustrate this point, a survivor analysis of the ransom payments for DeadBolt ransomware attacks showed that among the victims who paid, over 50% did so within 20 days, while 75% paid within 40 days.

For victims whose income relies on systems that have been affected by a ransomware attack, these systems must be fixed quickly, which explains the speed with which these victims concede to ransom demands. However, it’s important to note that paying the ransom only drives up the overall incident cost for victims: Even the eventual decryption of their data upon payment won’t undo the business disruption and brand reputation damage that a victim organization might have already suffered from the attack.

Figure 3. A Kaplan-Meier curve depicting the percentage of DeadBolt ransomware victims who paid the ransom versus the number of days until payment was made

Challengers are gunning for top spots in the ransomware arena

Our investigation of the leak sites of 69 ransomware groups demonstrated that, on average, a new victim’s data was leaked approximately every four days. Of these, the top 30 groups could be organized into four categories based on their victim count and the frequency with which they leak stolen victim data:

• Core groups are those that have been active for over a year, have over 300 leaks on their sites, and release new leaks every three days or less on average.
• Legends are no longer active but have more than 300 total leaks; they also used to release new leaks every three days or less.
• Regulars have been active for more than a year, have less than 300 leaks in total, and release new leaks more than every three days.
• Challengers have been active for less than a year and have less than 300 leaks in total. However, unlike regular groups, the periods between their leaks vary, so these groups need to be more closely monitored.

Using these categories to classify groups can enable incident responders and decision-makers to assess the state of the ransomware landscape, pinpointing any up-and-coming cybercriminal operations that might shape up to be a bigger threat in the future.

Figure 4. Grouping ransomware groups by duration days and victim counts

Mitigating ransomware attacks with a zero-trust approach

While there is no silver-bullet solution to ransomware, a zero-trust approach can help organizations detect malicious activity and minimize the impact of these cyberattacks. Implementing zero trust can help defenders profile known ransomware indicators so that they are better informed when updating their security policies and developing new alert rules. Defenders can also be informed immediately upon any signs of suspicious behavior in their organization’s systems, such as any of the following:

• Detection of outliers in pre-established profiles of what are considered normal encryption patterns, algorithms, and key lengths within an organization’s network.
• Detection of anomalous behavior in interhost connectivity profiles, as hosts should have set behaviors with regard to connections, communication peers, volume of transferred data, and the like.
• Detection of a 50/50 read-write ratio when files are encrypted on the host, as this could be outside the host’s normal behavior.
• Detection of partial encryption of files, as this is used by some ransomware families for speed optimization purposes.

Because there are so many variables that contribute to ransomware risk, it might be difficult for any one organization to fully fathom it from the perspective of just its own location and industry. Cross-country collaboration among business leaders and policymakers to create friction at any point in a ransomware group’s business processes can go a long way toward impeding these cybercriminals’ operations. To gain a better understanding of the intricacies that shape this cyberthreat, read our research paper, “What Decision-Makers Need to Know About Ransomware Risk: Data Science Applied to Ransomware Ecosystem Analysis.”