Ransomware is still top of mind because it's become a business. It has developed into something far beyond what it was ten years ago. At first, it was just the purview of a few hackers, but as it has grown into an industry, the sheer volume of attacks has increased dramatically. And like any other time the good guys fight it out with the bad guys, there are measures, countermeasures, and counter-countermeasures. Since the pandemic, more people have become aware of ransomware because hospitals were targeted. Because lives were threatened and hospitals couldn't take care of patients, that focused more media attention on the problem.
It's important to remember that ransomware started as a cottage industry run by individuals, but it has evolved into a business run by criminal organizations that now have built their own ecosystem. They don't just create the ransomware and put it into place. Now they have hot lines and boiler rooms where victims can contact them for info on how to pay the ransom. And it has grown to ransomware as a service, so you don't even need tech skills to wage an attack. You can simply hire someone to steal you some money; they do all the heavy lifting for a fee.
In the past, state-sponsored attackers used ransomware for political ends, like NotPetya five years ago. It was designed to attack the Ukraine government and organizations, but it didn't have controls built in, so it had unintended consequences and moved out of Ukraine and into the rest of the world. Because of the political situation in Eastern Europe, Ukraine, and elsewhere, these state-sponsored attacks are growing.
Wiper malware like NotPetya wipes out data whether or not a ransom is paid, which leaves victims totally at a loss with no recourse. Ransomware used to be simply a tactic, but now with the ecosystem and business model that has developed around it, ransomware can be used as a weapon of war. In the wake of Russia's attack on Ukraine, governments have issued warnings about the potential for more attacks, particularly because any organization can end up being collateral damage in a cyber war. Malware doesn't pay attention to country boundaries, and the reality is that ransomware could travel around the world in seconds.
Ricardo: Ransomware is still a top -of mind threat due to its prevalence, how it is readily available, and the impact that it causes. As we have seen in criminal groups for the past years, more tools and services have been identified. This is an issue as it enables low-skilled actors the potential to cause disruption.
Also an important aspect is that critical infrastructure, has been one of the most targeted sectors by criminals as well. Just this month Costa Rica declared a national emergency due to attacks from Conti ransomware on government bodies.