AND BLACKCAT LEAD PACK AMID RISE IN ACTIVE RAAS AND EXTORTION GROUPS
Ransomware actors were off to a running start in 2022, ramping up their activity as more gangs joined the fray. Using data from ransomware-as-a-service (RaaS) and extortion groups’ leak sites, Trend Micro’s open-source intelligence (OSINT) research, and the Trend Micro™ Smart Protection Network™, we mapped out the ransomware threat landscape of the first quarter (from Jan. 1 to March 31) of 2022. We tracked ransomware activity with a focus on the malicious actor groups behind the three ransomware families that pulled in the highest numbers of successful attacks during this period: the notorious LockBit and Conti, and the rising player BlackCat.To get more news about RaaS, you can visit glprobotics.com official website.
Our telemetry showed that during this three-month span, we detected and blocked a total of 4,439,903 ransomware threats across email, URL, and file layers. This is a 36.6% increase in overall ransomware threats from the previous quarter (the fourth quarter of 2021), and a 4.3% year-on-year rise (from the first quarter of 2021).
The number of RaaS and extortion groups grew by 63.2% in the first quarter of 2022 over the same period the previous year, an increase that inevitably led to more organizations falling prey to ransomware activity. According to the ransomware groups’ leak sites, which recorded attacks on successfully compromised organizations that refused to pay the ransom, ransomware victims rose by 29.2% year-on-year.The three ransomware families that laid claim to the highest numbers of successful attacks in the first quarter of 2022 were all widely known for operating under the RaaS model. Based on data from the leak sites of their operators, 35.8% of these attacks were attributed to LockBit, while 19% belonged to Conti and 9.6% to BlackCat.
Based on our ransomware data, which tracked detections of ransomware attempts to compromise organizations, LockBit and Conti were among the top 10 families detected in the entire first quarter of 2022. Meanwhile, BlackCat was among the top 10 ransomware families detected in February and March 2022.
Of the three, only Conti was among the top active ransomware families in the first quarter of 2021, based on RaaS and extortion groups’ leak sites. In fact, Conti was first among them in that period, racking up a victim count of 105. The Federal Bureau of Investigation (FBI) estimates that the group behind Conti, which Trend Micro tracks as Water Goblin, has amassed more than 1,000 victims and payouts amounting to over US$150 million as of January 2022, making it one of the costliest ransomware families ever documented.
RaaS providers like LockBit, detections of which were at their highest in the first quarter of 2022 in February, have become an even more formidable threat since incorporating double extortion in their playbooks. Under double extortion, ransomware actors not only encrypt their victims’ data and demand payment in exchange for restoration of access, but they also put additional pressure on victims by threatening to release the data if the ransom is not paid. LockBit operators relied on this tactic after they took credit for an attack on France’s Ministry of Justice in January 2022, threatening to publish sensitive ministry data on the dark web upon failure of payment.
Relative to Conti and LockBit, BlackCat (aka AlphaVM, AlphaV, or ALPHV) is a newcomer; it was first reported in November 2021 by researchers from MalwareHunterTeam. But what sets it apart from many other RaaS operators is its use of triple extortion, a tactic where ransomware actors threaten to launch distributed denial-of-service (DDoS) attacks on their victims’ infrastructure on top of leaking their data unless the ransom is paid. BlackCat demands millions of US dollars in bitcoin or monero from its victims. It is shaping up to be a major contender in the underground marketplace, thanks to its generous payouts to its RaaS affiliates, who can earn as much as 90% of paid ransoms.
BlackCat, which our detections showed was most active in the first quarter of 2022 in February, has successfully compromised at least 60 organizations around the world as of March. BlackCat is also notable for being the first professional ransomware family to be written in Rust. This is a major selling point for BlackCat, as Rust is considered a more secure programming language that is capable of concurrent processing. As a cross-platform language, Rust also makes it easier for threat actors to tailor malware to different operating systems like Windows and Linux.
Ransomware actors were off to a running start in 2022, ramping up their activity as more gangs joined the fray. Using data from ransomware-as-a-service (RaaS) and extortion groups’ leak sites, Trend Micro’s open-source intelligence (OSINT) research, and the Trend Micro™ Smart Protection Network™, we mapped out the ransomware threat landscape of the first quarter (from Jan. 1 to March 31) of 2022. We tracked ransomware activity with a focus on the malicious actor groups behind the three ransomware families that pulled in the highest numbers of successful attacks during this period: the notorious LockBit and Conti, and the rising player BlackCat.To get more news about RaaS, you can visit glprobotics.com official website.
Our telemetry showed that during this three-month span, we detected and blocked a total of 4,439,903 ransomware threats across email, URL, and file layers. This is a 36.6% increase in overall ransomware threats from the previous quarter (the fourth quarter of 2021), and a 4.3% year-on-year rise (from the first quarter of 2021).
The number of RaaS and extortion groups grew by 63.2% in the first quarter of 2022 over the same period the previous year, an increase that inevitably led to more organizations falling prey to ransomware activity. According to the ransomware groups’ leak sites, which recorded attacks on successfully compromised organizations that refused to pay the ransom, ransomware victims rose by 29.2% year-on-year.The three ransomware families that laid claim to the highest numbers of successful attacks in the first quarter of 2022 were all widely known for operating under the RaaS model. Based on data from the leak sites of their operators, 35.8% of these attacks were attributed to LockBit, while 19% belonged to Conti and 9.6% to BlackCat.
Based on our ransomware data, which tracked detections of ransomware attempts to compromise organizations, LockBit and Conti were among the top 10 families detected in the entire first quarter of 2022. Meanwhile, BlackCat was among the top 10 ransomware families detected in February and March 2022.
Of the three, only Conti was among the top active ransomware families in the first quarter of 2021, based on RaaS and extortion groups’ leak sites. In fact, Conti was first among them in that period, racking up a victim count of 105. The Federal Bureau of Investigation (FBI) estimates that the group behind Conti, which Trend Micro tracks as Water Goblin, has amassed more than 1,000 victims and payouts amounting to over US$150 million as of January 2022, making it one of the costliest ransomware families ever documented.
RaaS providers like LockBit, detections of which were at their highest in the first quarter of 2022 in February, have become an even more formidable threat since incorporating double extortion in their playbooks. Under double extortion, ransomware actors not only encrypt their victims’ data and demand payment in exchange for restoration of access, but they also put additional pressure on victims by threatening to release the data if the ransom is not paid. LockBit operators relied on this tactic after they took credit for an attack on France’s Ministry of Justice in January 2022, threatening to publish sensitive ministry data on the dark web upon failure of payment.
Relative to Conti and LockBit, BlackCat (aka AlphaVM, AlphaV, or ALPHV) is a newcomer; it was first reported in November 2021 by researchers from MalwareHunterTeam. But what sets it apart from many other RaaS operators is its use of triple extortion, a tactic where ransomware actors threaten to launch distributed denial-of-service (DDoS) attacks on their victims’ infrastructure on top of leaking their data unless the ransom is paid. BlackCat demands millions of US dollars in bitcoin or monero from its victims. It is shaping up to be a major contender in the underground marketplace, thanks to its generous payouts to its RaaS affiliates, who can earn as much as 90% of paid ransoms.
BlackCat, which our detections showed was most active in the first quarter of 2022 in February, has successfully compromised at least 60 organizations around the world as of March. BlackCat is also notable for being the first professional ransomware family to be written in Rust. This is a major selling point for BlackCat, as Rust is considered a more secure programming language that is capable of concurrent processing. As a cross-platform language, Rust also makes it easier for threat actors to tailor malware to different operating systems like Windows and Linux.