Threatline

How ransomware gangs went pro

Cybercriminal groups started deploying post-intrusion ransomware in 2015, which involved human attackers gaining initial access to the system and moving laterally through the organization until it found the appropriate target. Attack groups have repeatedly upped the ante, evolving with JavaScript-based ransomware and fileless attacks. Ransomware groups are constantly shifting, inheriting software from other groups while vanishing from view to avoid scrutiny from law enforcement only to resurface under other names, warns Darktrace. Experts pegged WannaCry, one of the most famous ransomware attacks in history, as a North Korean venture. Some criminal groups and ransomware forums dictate sectors that their affiliates must avoid, with several groups signalling their unwillingness to hit the healthcare industry. The company warns that those wanting to mitigate ransomware attacks will increasingly need to use AI as a defensive tool. As the money keeps flowing and attackers get ever-bolder, companies should be taking the ransomware threat seriously.