The problem of ransomware is largely a structural one. It’s going to be hard for any single event to really make a dent, even a war. It’s true we have seen some groups of threat actors implode due to fallout from the war, and on top of that one of the best things we have going for us right now in the fight against ransomware is the prices of cryptocurrencies dropping. All that being said, there is still so much money to be made that the structural problem is not going away. We expect that most of these threat actors will get their acts together again, and flourish.
The biggest reason for the structural nature of the problem is that the criminal underground is really a marketplace. It’s easy to see the major ransomware group names in the headlines and think that these big groups are the center of the problem. But the reality of it is that a ransomware attack is a series of transactions between multiple players. Somebody might gain access to your systems, then sell that access to an intrusion operations team. That team might build out the access to your organization, then work with the actual ransomware group on deploying the ransomware and negotiating with the target. With three different unique “players,” if one gets shut down they can simply work with others — an intrusion team can work with multiple ransomware service groups simultaneously. There is a fully developed underground economy and marketplace. For us, it’s like a game of Whac-A-Mole.