Top 10 Ransomware Attacks

Ransomware Definition

Ransomware is a type of malware (malicious software) that threatens to publish or prevent access to data or a computer system, typically by encrypting it. The victim is faced with the ultimatum of either paying a ransom or risking the publication or permanent loss of their data or access to their system. The ransom demand usually involves a deadline. If the victim doesn’t pay on time, the data is permanently lost, or the ransom is increased.

Attacks using ransomware are all too frequent these days. It has affected both large firms in North America and Europe. Cybercriminals will target any customer or company, and victims come from every sector of the economy.

The FBI and other government agencies, as does the No More Ransom Project, advise against paying the ransom to prevent the ransomware cycle because it doesn’t ensure retrieval of the encrypted data. If the ransomware is not removed from the system, 50% of the victims who pay the ransom will likely experience further attacks.

History and Future of Ransomware

According to Becker’s Hospital Review, the first known ransomware attack occurred in 1989 and targeted the healthcare industry. 28 years later, the healthcare industry remains a top target for ransomware attacks.

The first known attack was initiated in 1989 by Joseph Popp, Ph.D., an AIDS researcher, who attacked by distributing 20,000 floppy disks to AIDS researchers spanning more than 90 countries, claiming that the disks contained a program that analyzed an individual’s risk of acquiring AIDS through the use of a questionnaire.

However, the disk also contained a malware program that initially remained dormant in computers, only activating after a computer was powered on 90 times. After the 90-start threshold was reached, the malware displayed a message demanding a payment of $189 and another $378 for a software lease. This ransomware attack became known as the AIDS Trojan or the PC Cyborg.

There will be no end to ransomware anytime soon. Ransomware as a service raas attacks have skyrocketed in 2021 and will continue to rise. About 304.7 million ransomware attacks were attempted in the first half of 2021, and many attacks went unreported as per Ransomware statistics 2021.

A recent report by Tripwire supported the fact that ransomware will keep growing, and the post-ransomware costs will keep climbing significantly. There’s no denying the fact that Ransomware is being used as a weapon, and how ransomware spreads is no longer a mystery.

Modern-day attacks target operational technology, operating system, medical and healthcare services, third-party software, and IoT devices. Fortunately, organizations don’t have to be sitting ducks; they can minimize the risk of attacks by being proactive and having a reliable ransomware data recovery infrastructure.

Top Ransomware Attacks

1. Kia Motors

Kia Motors America (KMA) was hit by a ransomware attack in February that hit both internal and customer-facing systems, including mobile apps, payment services, phone services, and dealership systems. The hack also impacted customers’ IT systems that were required to deliver new vehicles.

DoppelPaymer was thought to be the ransomware family that hit Kia, and the threat actors claimed to have also targeted Kia’s parent business, Hyundai Motors America. Similar system failures were also experienced by Hyundai.

On the other hand, Kia and Hyundai denied being assaulted, a frequent approach victims use to protect their reputation and customer loyalty.

2. CD Projekt Red

In February 2021, a ransomware attack hit CD Projekt Red, a video game studio located in Poland, causing significant delays in developing their highly anticipated next release, Cyberpunk 2077. The threat actors apparently stole source codes for numerous of the company’s video games, including Cyberpunk 2077, Gwent, The Witcher 3, and an unpublished version of The Witcher 3.

According to CD Projekt Red, the unlawfully obtained material is currently being distributed online. Following the incident, the company installed many security measures, including new firewalls with anti-malware protection, a new remote-access solution, and a redesign of critical IT infrastructure, according to the company.

3. Acer

Acer, a Taiwanese computer manufacturer, was hit by the REvil ransomware outbreak in March. This attack was notable because it demanded a ransom of $50,000,000, the greatest known ransom to date.

According to Advanced Intelligence, the REvil gang targeted a Microsoft Exchange server on Acer’s domain before the attack, implying that the Microsoft Exchange vulnerability was weaponized.

4. DC Police Department

The Metropolitan Police Department in Washington, D.C., was hit by ransomware from the Babuk gang, a Russian ransomware syndicate. The police department refused to pay the $4 million demanded by the group in exchange for not exposing the agency’s information and encrypted data.

Internal material, including police officer disciplinary files and intelligence reports, was massively leaked due to the attack, resulting in a 250GB data breach. Experts said it was the worst ransomware attack on a police agency in the United States.

5. Colonial Pipeline

The Colonial Pipeline ransomware assault in 2021 was likely the most high-profile of the year. The Colonial Pipeline transports roughly half of the fuel on the East Coast. The ransomware attack was the most significant hack on oil infrastructure in US history.

On May 7, the DarkSide group infected the organization’s computerized pipeline management equipment with ransomware. DarkSide’s attack vector, according to Colonial Pipeline’s CEO, was a single hacked password for an active VPN account that was no longer in use. Because Colonial Pipeline did not use multi-factor authentication, attackers could access the company’s IT network and data more quickly.

6. Brenntag

In May, Brenntag, a German chemical distribution company, was also struck by a DarkSide ransomware attack around the same time as Colonial Pipeline. According to DarkSide, the hack targeted the company’s North American business and resulted in the theft of 150 GB of critical data.

They got access by buying stolen credentials, according to DarkSide affiliates. Threat actors frequently buy stolen credentials — such as Remote Desktop credentials — on the dark web, which is why multi-factor authentication and detecting unsafe RDP connections are critical.

The first demand from DarkSide was 133.65 Bitcoin, or nearly $7.5 million, which would have been the highest payment ever made. Brenntag reduced the ransom to $4.4 million through discussions, which they paid.

7. Ireland’s Health Service Executive (HSE)

In May 2021, a variation of Conti ransomware infected Ireland’s HSE, which provides healthcare and social services. The organization shut down all of its IT systems after the incident. Many health services in Ireland were impacted, including the processing of blood tests and diagnoses.

The firm refused to pay the $20 million ransom in Bitcoin because the Conti ransomware group provided the software decryption key for free. However, the Irish health service was still subjected to months of substantial disruption as it worked to repair 2,000 IT systems that had been infected by ransomware.

8. JBS

Also, in May 2021, JBS, the world’s largest meat processing plant, was hit by a ransomware attack that forced the company to stop the operation of all its beef plants in the U.S. and slow the production of pork and poultry. The cyberattack significantly impacted the food supply chain and highlighted the manufacturing and agricultural sectors’ vulnerability to disruptions of this nature.

The FBI identified the threat actors as the REvil ransomware-as-a-service operation. According to JBS, the threat actors targeted servers supporting North American and Australian IT systems. The company ultimately paid a ransom of $11 million to the Russian-based ransomware gang to prevent further disruption.

9. Kaseya

Kaseya, an IT services company for MSP and enterprise clients, was another victim of REvil ransomware — this time during the July 4th holiday weekend. Although only 1% of Kaseya’s customers were breached, an estimated 800 to 1500 small to mid-sized businesses were affected through their MSP. One of those businesses included 800 Coop stores, a Sweden-based supermarket chain that was forced to temporarily close due to an inability to open their cash registers.

The attackers identified a chain of vulnerabilities — ranging from improper authentication validation to SQL injection — in Kaseya’s on-premises VSA software, which organizations typically run in their DMZs. REvil then used MSP’s Remote Monitoring and Management (RMM) tools to push out the attack to all connected agents.

10. Accenture

The ransomware gang LockBit hit Accenture, the global tech consultancy, with an attack in August that resulted in a leak of over 2,000 stolen files. The slow leak suggests that Accenture did not pay the $50 million ransom.

According to CyberScoop, Accenture knew about the attack on July 30 but did not confirm the breach until August 11, after a CNBC reporter tweeted about it. CRN criticized the firm for its lack of transparency about the attack, saying that the incident was a “missed opportunity by an IT heavyweight” to help spread awareness about ransomware.

Bonus: CNA Financial (2021)

CNA Financial, the seventh largest commercial insurer in the United States, announced on March 23, 2021, that it had “experienced a sophisticated cybersecurity attack.” Phoenix Locker ransomware was used in the attack, which was carried out by a group called Phoenix.

CNA Financial paid $40 million in May 2021 to regain access to the data. While CNA has been tight-lipped about the specifics of the negotiation and sale, it claims that all of its systems have been fully restored since then.

Types of ransomware:

There are two main types of ransomware:

1. Crypto Ransomware

   Crypto ransomware encrypts files on a computer so the user cannot access them.

2. Locker Ransomware

   Does not encrypt files. Rather, it locks the victim out of their device, preventing them from using it. Once they are locked out, cybercriminals carrying out locker ransomware attack demands a ransom to unlock the device.

Now you understand what ransomware is and the two main types of ransomware that exist. Let’s explore 10 types of ransomware attacks to help you understand how different and dangerous each type can be.

• Locky

  Locky is a type of ransomware that was first released in a 2016 attack by an organized group of hackers. With the ability to encrypt over 160 file types, Locky spreads by tricking victims to install it via fake emails with infected attachments. This method of transmission is called phishing, a form of social engineering. Locky targets a range of file types that are often used by designers, developers, engineers, and testers.

• WannaCry

  WannaCry is a ransomware attack that spread across 150 countries in 2017. Designed to exploit a vulnerability in Windows, it was allegedly created by the United States National Security Agency and leaked by the Shadow Brokers group. WannaCry affected 230,000 computers globally. The attack hit a third of hospital trusts in the UK, costing the NHS an estimated £92 million. Users were locked out and a ransom was demanded in the form of Bitcoin. The attack highlighted the problematic use of outdated systems, leaving the vital health service vulnerable to attack. The global financial impact of WannaCry was substantial -the cybercrime caused an estimated $4 billion in financial losses worldwide.

• Bad Rabbit

  Bad Rabbit is a 2017 ransomware attack that spread using a method called a ‘drive-by’ attack, where insecure websites are targeted and used to carry out an attack. During a drive-by ransomware attack, a user visits a legitimate website, not knowing that they have been compromised by a hacker. Drive-by attacks often require no action from the victim, beyond browsing the compromised page. However, in this case, they are infected when they click to install something that is malware in disguise. This element is known as a malware dropper. Bad Rabbit used a fake request to install Adobe Flash as a malware dropper to spread its infection.

• Ryuk

  Its a ransomware, which spread in August 2018, disabled the Windows System Restore option, making it impossible to restore encrypted files without a backup. Ryuk also encrypted network drives. The effects were crippling, and many organizations targeted in the US paid the demanded ransoms. August 2018 reports estimated funds raised from the attack were over $640,000.

• Troldesh

  The Troldesh ransomware attack happened in 2015 and was spread via spam emails with infected links or attachments. Interestingly, the Troldesh attackers communicated with victims directly over email to demand ransoms. The cybercriminals even negotiated discounts for victims with who they built a rapport with — a rare occurrence indeed. This tale is the exception, not the rule. It is never a good idea to negotiate with cybercriminals. Avoid paying the demanded ransom at all costs as doing so only encourages this form of cybercrime.

• Jigsaw

  Jigsaw is a ransomware attack that started in 2016. This attack got its name as it featured an image of the puppet from the Saw film franchise. Jigsaw gradually deleted more of the victim’s files each hour that the ransom demand was left unpaid. The use of horror movie imagery in this attack caused victims additional distress.

• CryptoLocker

  CryptoLocker is ransomware that was first seen in 2007 and spread through infected email attachments. Once on your computer, it searched for valuable files to encrypt and hold to ransom. Thought to have affected around 500,000 computers, law enforcement, and security companies eventually managed to seize a worldwide network of hijacked home computers that were being used to spread Cryptolocker. This allowed them to control part of the criminal network and grab the data as it was being sent, without the criminals knowing. This action later led to the development of an online portal where victims could get a key to unlock and release their data for free without paying the criminals.

• Petya

  Petya (not to be confused with ExPetr) is a ransomware attack that first hit in 2016 and resurged in 2017 as GoldenEye. Rather than encrypting specific files, this vicious ransomware encrypts the victim’s entire hard drive. It does this by encrypting the primary file table, making accessing files on the disk impossible. Petya spread through HR departments via a fake job application email with an infected Dropbox link.

• GoldenEye

  The resurgence of Petya, known as GoldenEye, led to a global ransomware attack that happened in 2017. Dubbed WannaCry’s ‘deadly sibling,’ GoldenEye hit over 2,000 targets, including prominent oil producers in Russia and several banks. Frighteningly, GoldenEye even forced workers at the Chernobyl nuclear plant to check radiation levels manually as they had been locked out of their Windows PCs.

• GandCrab

  GandCrab is a rather unsavory famous ransomware attack that threatened to reveal the victim’s porn-watching habits. Claiming to have a high-jacked user’s webcam, GandCrab cybercriminals demanded a ransom, or otherwise, they would make the embarrassing footage public. After having first hit in January 2018, GandCrab evolved into multiple versions. As part of the No More Ransom Initiative, internet security providers and the police collaborated to develop a ransomware decryptor to rescue victims’ sensitive data from GandCrab.

  Contact Us

How to Spot a Ransomware Email

You now know about the various types of ransomware attacks that have been perpetrated against individuals and businesses in recent years. Many of the victims of the ransomware attacks we’ve mentioned became infected after clicking on links in spam or phishing emails or opening malicious attachments.

So, how can you avoid being a victim of a ransomware assault if you receive a ransomware email? Checking the sender is the easiest approach to recognizing a ransomware email. Is it from a reliable source? Always be cautious if you receive an email from someone or a firm you don’t recognize.

Never open email attachments from senders you don’t trust, and never click on links in emails from untrustworthy sources. If the attachment asks you to activate macros, proceed with caution. This is a popular method of ransomware distribution.