Dark Angels Gang Scores Record-Breaking $75 Million Ransom

Ransomware attacks have escalated dramatically, with a record-breaking $75 million ransom paid and over $1 billion in total payments during 2023. Threat actors employ increasingly sophisticated tactics, including targeting executive families, to extort maximum ransom. 

The manufacturing, healthcare, and technology sectors are primary targets. Despite law enforcement efforts, ransomware groups rapidly regroup and continue attacks, highlighting the growing challenge of combating this evolving threat. 

The number of ransomware attacks had increased by 17.8 percent, and the number of data leak sites that hosted companies that were extorted had increased by 57.8 percent. 

The most active ransomware families are LockBit, BlackCat, and 8Base, with the US remaining the top target after the UK, Germany, Canada, and France. 

Vulnerabilities remain a common attack vector, emphasizing the need for timely patching and a zero-trust architecture. Voice-based social engineering attacks are emerging as a new threat vector. 

Ransomware attacks surged from April 2023 to April 2024, targeting specific industries and geographies. Threat actors leveraged AI, stolen code, and advanced encryption to maximize impact and profits. 

Law enforcement intensified efforts against ransomware groups and initial access brokers, while record-breaking ransom payments highlighted the evolving and increasingly costly threat landscape. 

Ransomware attacks frequently leverage vulnerabilities in internet-exposed systems like gateways and VPNs. CISA actively tracks these vulnerabilities, many of which reside within organizations’ external attack surfaces. 

Prioritizing vulnerability management, especially for remote connectivity technologies, is crucial. Adopting security frameworks like zero trust architecture, SSE, and SASE can significantly mitigate risks by enforcing granular access controls. 

Ransomware attacks that have occurred in recent times have specifically targeted and exploited vulnerabilities that affect a wide variety of computer systems.

Ransomware attacks on healthcare organizations have surged, disrupting critical services, compromising patient data, and incurring significant financial losses. 

The BlackCat ransomware attack on a provider of healthcare technology serves as an example of how paying ransoms is no guarantee of data recovery or protection from additional extortion. 

Repeated ransomware incidents targeting the same organization, as seen in a pharmaceutical distributor case, highlight the growing threat of double extortion and prolonged operational disruption. 

Ransomware threat actors are shifting to highly targeted attacks on large enterprises, imitating the Dark Angels group’s lucrative strategy, which increasingly uses voice-based social engineering to gain initial access with the help of specialized brokers. 

According to ZScaler Threat Lab, the evolving threat landscape necessitates robust security measures to counter sophisticated attacks leveraging human vulnerabilities and collaborative cybercriminal ecosystems. 

Also Read:

• Google Ads Hijacked: Weaponized Authenticator Steals Your Data
• Massive Phishing Campaign Unleashes Multiple Malware