What Makes an Ideal Ransomware Victim?

 According to a new report by Israeli security company Kela, the most critical aspects that affect companies becoming victims of ransomware are location, revenue, and ease of access.

Does Your Company Measure Up?

During July of this year, Kela monitored dozens of cybercriminal discussion forums to learn what makes the new ransomware targets. Many of the discussions were current and had recently been created, indicating that the viability of purchasing access into a company network is still a very real threat.

The purpose of these discussions is for buyers to purchase “access” rather than waste precious time trying to hack into a network or breach company infrastructure with various tactics. Sometimes hackers take weeks and even months trying to collect login credentials through phishing campaigns or other social engineering methods. Therefore, it’s much easier to just purchase access from another hacker or someone inside the company who is disgruntled or looking to make a quick buck.

According to Data Breach Today, “When dealing with initial access brokers, the access being sold may include network access, but most often refers to the ability to buy working RDP or VPN credentials, writes Victoria Kivilevich, a threat intelligence analyst at Kela who authored the new report. Based on the forum posts Kela reviewed, she says other most-desired products for facilitating access  include:

• Cisco.
• Citrix.
• Fortinet.
• Palo Alto Networks - including GlobalProtect VPN.
• VMware, including ESXi.”

Other desirable traits of an ideal victim, from the hacker’s perspective, are:

• Any industry except medicine and government/state agencies.
• Revenue of 100 million+.
• 500-1,500 hosts.
• Based in the USA, THAT, TO, and GB.

Of the hackers monitored, almost 50% want victims in the U.S. Additionally, “37% said they wanted Canadian or Australian victims, and 32% sought victims in Europe.”

The trend appears to be hacking groups targeting larger companies for higher ransoms which they dub “big game hunting.”  One of the reasons they target UK and U.S. companies is that many of the wealthiest companies are in those two locations, and these areas are more well developed, meaning cyber insurance and bigger payouts.

A big no-no for hackers is targeting companies in Russia since many of the notorious hacker groups hail from there. Another factor governing the victim pool is industry. Many hacker groups want to stay away from healthcare organizations. However, as we have seen over the past two years, many do not honor that code. Education and nonprofits are viewed as too much trouble for too little payoff.

Some groups also shy away from attacking government agencies due to the involvement of federal law enforcement.

Although this list is very detailed, many “access deals” take place in private, off the public forums, which may alter these results.

How Much Do Hackers Pay for Access?

The report also mentioned that hackers typically pay around $1,600 for access, but some have shelled out as much as $56,250. In other cases, those supplying the credentials may take a cut of any ransomware collected, usually around 10% of the full take.

How Companies Can Protect Themselves from Being a New Ransomware Target 

Turning a negative into a positive, companies can better secure their networks using this hacker list of must-haves by first locking down all RDP and VPN access. Other tips include:

• Enable multi-factor authentication all around, especially with Active Directory. 
• Secure admin accounts and verify access-level privileges to all online resources.
• Keep a current list of all digital assets.
• Store good backups off-site.
• Update software and hardware to include the latest security patches.
• Educate employees on safe online practices and phishing and social engineering tactics.