Sanctions and law enforcement efforts are effective.
This past year, the United States government has been more public (and bolder) in their efforts to combat cyber threats. In May 2021, a presidential briefing declared that the Federal Government “must improve its efforts to identify, deter, protect against, detect, and respond to these actions and actors.” In September, the US OFAC announced sanctions that specifically target intermediary businesses enabling ransomware operations, like certain cryptocurrency exchanges.
The impact of Russian state directives on ransomware actors.
Let us be clear: these are murky waters. We don’t know to what extent Russian state agencies, such as the FSB, play a role in ransomware activity, but we do know they are in contact with certain groups and provide them safe harbor. It could be that the Russian government has instructed groups to avoid US targets. But again, there is much we don’t know about these relationships so we believe that sanctions are the most reliable answer as to why the US is experiencing a lull in ransomware activity.