New Entrants to Ransomware Unleash Frankenstein Malware

•
June 9, 2023    

Ransomware hackers are stretching the concept of code reuse to the limit as they confront the specter of diminishing returns for extortionate malware.

See Also: Live Webinar | Breaking Down Security Challenges so Your Day Doesn’t Start at 3pm

Users are more reluctant to pay even as opportunistic entrants, perhaps less sophisticated than their predecessors, join the market and show less willingness to abide by the ransomware trade-off: money for system restoration.

At the beginning of the year, experts who work with victims and track the cybercrime ecosystem, including via cryptocurrency flows, reported seeing fewer ransoms being paid and less being paid on average when victims did pay.

Cyber insurer Corvus reported that the percentage of its policyholders who paid a ransom dropped from 33% in 2021 to 28% in 2022. Ransomware incident response firm Coveware reported that for victims it assisted, 41% shelled out in 2022 versus 79% in 2019.

That constricting market – the result of hardening attitudes toward mainly Russian extortion groups and cyber defender activity – isn’t deterring new actors from attempting to cash in on the shrinking bonanza. In their haste to make money, some new players are picking over the discarded remnants of previous ransomware groups, cobbling together ransomware rather than going through the trouble of coding bespoke crypto-locking software.

Call it Frankenstein ransomware, said Allan…