Ransomware payments fail to prevent repeat attacks, new data shows | brief | #ransomware | #cybercrime

As outlined in The Register, new data from Proofpoint revealed that a significant portion of organizations in the UK continue to pay ransom demands, despite evidence that doing so does not guarantee an end to extortion or the recovery of data. This trend persists even as law enforcement efforts, like Operation Cronos, aim to dismantle ransomware operations.Proofpoint’s findings indicate that 58% of extorted organizations in Britain pay ransoms, with a concerning 22% of these victims facing subsequent extortion attempts. Globally, 54% of victims pay, though regional variations exist. The data suggests that paying criminals does not restore the status quo, as attackers may still retain stolen data or fail to provide working decryption keys.Operation Cronos, which targeted the LockBit ransomware gang, provided concrete evidence that cybercriminals often keep victim data even after payment. Furthermore, some victims who pay never recover their files, sometimes due to coding errors in decryption tools.The report highlights that AI is increasingly being used to enhance the initial stages of ransomware attacks, such as creating more convincing phishing emails and improving reconnaissance, rather than directly within the ransomware payload itself. Experts emphasize that focusing on human vulnerabilities, identities, and trusted communications is crucial for building cyber-resilience, as ransomware is often preceded by attacks targeting these areas.Source: The Register