The Ransomware Pandemic: Why These Cyber Attacks are So Lucrative and Difficult to Stop

Ransomware attacks have been on the rise this summer, with Lockbit 3.0 leading the pack, trailed by Hiveleaks and BlackBasta, both offshoots of the Conti group. According to NCC Group’s data, the month of July saw Lockbit behind 62 attacks, ten more than the previous month, and the second and third groups combined were not even close to Lockbit’s numbers. The authors of the study warn organizations to be aware of Lockbit, stating that it is the most threatening ransomware group currently.

## The Resurgence of Ransomware

The numbers released by NCC Group reveal that there were a total of 198 successful ransomware campaigns in July, a 47 percent increase from June, but still a far cry from the almost 300 campaigns that were carried out in both March and April. The report speculates that the restructuring of the Russia-based gang Conti may have played a role in the rise of ransomware attacks, with Hiveleaks and BlackBasta emerging as its offshoots. The report also mentions that the US government’s move against Conti also contributed to the rise of the attacks, as the gang may have been undergoing structural changes.

## The New Contenders

According to the report, Hiveleaks and BlackBasta are Conti’s new identities, and both are closely associated with the group. Hiveleaks is an affiliate, while BlackBasta is a replacement strain. The report indicates that it is not surprising to see the numbers of ransomware attacks increase further, considering Conti’s restructuring.

## Editorial and Recommendations

Ransomware attacks can be debilitating for individuals, businesses, and organizations alike. It’s important to take appropriate measures to protect oneself or one’s organization from such attacks. These measures might include avoiding suspicious emails and links, regularly updating the software, installing anti-virus software, and backing up important files regularly. Cybersecurity awareness and training initiatives could also go a long way in deterring attacks.

Governments must launch efforts to crackdown on the groups behind ransomware attacks, as it is only through sustained action that we can prevent these attacks in the first place. Stronger international cooperation will also be necessary, given the transnational nature of this problem. Ransomware groups should be treated as criminal organizations and held accountable for their actions.

In conclusion, the resurgence of ransomware attacks, coupled with the emergence of new groups, should be a cause for concern for individuals, organizations, and governments alike. Preventative measures, education, and greater international cooperation will be required to tackle this threat effectively.