Something state and local governments have become more concerned about are growing social engineering attacks and about increased sophisticated (APT) nation-state activities potentially directed against them. The changing dynamic of geopolitical conflict has led many to reflect on their position in the landscape and to wonder if they are likely to be in the crosshairs or to be caught in the crossfire as collateral damage of a conflict occurring on the other side of the world. However, I think the last year has shown ransomware to be the most impact, and threat to state and local governments.
Ransomware has offered threat actors a steady revenue stream that is not as unpredictable as malicious activities such as running botnets or illegal cryptocurrency mining, where relative success various with the actions or law enforcement or technology companies. Rather, ransomware always seems to generate a consistent pay off. Because of the success of this attack trend, we're starting to see the rise of advanced persistent crime that's starting to look like advanced persistent threat activity by nation-states. Criminals ‘follow the money’ and based on the steady cash flow from ransomware, many criminal groups becoming more are cohesive and enduring. Because they have organizational persistence, they can hire and retain specialists in areas such as vulnerability research. Many of these groups are becoming faster to weaponize exploits. They're so specialized they have help desks for the affiliates they rent their ransomware to and for victims who don’t understand how to buy cryptocurrency. It's not only crime, it's crime that is becoming faster, more sophisticated, and more clandestine.