Six-in-ten ransomware victims are still paying up despite official advice not to do so.
That’s according to research from security firm Proofpoint, which found that 58% of UK organizations hit by a ransomware attack agreed to pay ransoms.
Crucially, Proofpoint found they weren’t rewarded for bowing to cyber criminal demands. Nearly one-quarter (22%) who did pay were then hit with a second extortion demand.
The study from Proofpoint comes amidst growing calls to play hard ball with ransomware criminals by authorities. The UK’s National Cyber Security Centre (NCSC), for example, advises against paying ransoms, warning that it encourages further attacks and may not lead to the return of data.
Despite that being the official advice for many years, plenty of companies pay criminals when faced with ransomware disruption to their business operations.
Security firm Trellix surveyed CISOs whose employers had been the target of ransomware attacks, finding in each instance they decided it was worth paying — with a third paying between $5 million and $15 million.
Those results were echoed by research from Cohesity that showed that while 94% of companies in the UK say they have a policy not to pay out in a ransomware attack, 97% still do.
The case for ransom bans
This disconnect has led to debate over banning ransomware payments, with the UK government saying last year it was considering forbidding public organizations from paying ransoms.
These proposals follow serious incidents at NHS bodies, the British Library, and Royal Mail in recent years.
The government already bans ransomware payments made by its own departments; a wider ban was backed by the government, but has yet to be brought into force.
That included a provision for mandatory reporting of ransomware payments for private companies not covered by the ban. One challenge is enforcement, as fines or other punishments for paying ransoms could risk further victimizing companies.
Evolving techniques raise the stakes
Elsewhere in the study, Proofpoint found new tactics are exacerbating the situation for enterprises.
Ransomware techniques have shifted away from data encryption to outright data theft – and that means companies can expect that data to be used for follow-up attacks or sold on criminal marketplaces.
The result here is that this extends the initial attack and impact for victims, according to Proofpoint.
The rise of AI has also made ransomware more effective, according to two-thirds of companies that faced an attack, particularly in terms of initial compromise.
“AI hasn’t fundamentally changed ransomware, but it has materially improved the attacks that lead to it,” said Ryan Kalember, chief strategy officer at Proofpoint. “Today’s attackers are using AI to create highly convincing phishing emails and credential theft campaigns that exploit human trust at scale.”
Hackers are using AI to write better phishing messages and to better hide their attacks, with 31% of those polled said staff didn’t suspect anything was wrong when they interacted with malicious content.
Around one-quarter (24%) said attacks succeeded because they appeared to be authentic communications.
The Proofpoint survey found that malicious links remained the most common threat at 40%, followed by compromised email at 35% and credential harvesting at 32%.
“Organizations that continue treating ransomware as an endpoint or recovery problem are missing where these attacks most frequently begin: people, identities and trusted communications,” added Kalember.
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
