The dozens of ransomware attacks in the United States in July included incidents at Susan B. Allen Memorial Hospital in Kansas, Cookeville Regional Medical Center in Tennessee, and California-based IT company Ingram Micro.
But those figures do not include the vast majority of attacks, which were not reported, according to Andy Jenkinson, fellow at the Cyber Theory Institute and author of the book “Stuxnet to Sunburst: 20 Years of Digital Exploitation and Cyber Warfare.”
“Ransomware is huge,” he told The Epoch Times. “Ransoms are being paid left, right, and center. There are two types of ransomware attacks: one that becomes public and one that becomes covered up.”
Ransoms Paid in Crypto
Jenkinson said ransoms are almost always paid in bitcoin and other cryptocurrencies, which are harder to trace than bank transfers.
Adnan Malik, a lawyer who is head of data protection at Barings Law in Manchester, UK, told The Epoch Times that companies do not openly declare that they have paid a ransom.
“They will try and brush it under the carpet,” Malik said. “They will try and disguise it as some other expense.”
He said companies often haggle with ransomware attackers.
“Hackers will start with a very absurd amount, and it’s not uncommon for a demand in millions to be reduced to a couple of hundred thousand,” he said. “It happens all the time.”
“We would in general discourage victims from paying ransoms, but every victim needs to make their own choice,” he said.
Abbott told The Epoch Times that a night shift worker had noticed a problem with the company’s computer systems and called in the IT support team, which initially did not think that it was anything malicious.
He said the team carried out a controlled shutdown restart.
“During the restart, they discovered a text file which was embedded into one of the servers that was a ransom note from the Akira group, and obviously the root cause of the issue became very clear at that point,” he said.
Akira is one of the best-known ransomware groups.
Enforcement Efforts
On July 22, the UK government announced plans to ban ministries, state-owned agencies, schools, hospitals, and operators of critical national infrastructure from paying ransom demands to cybercriminals.Jenkinson said other issues need to be addressed first.
“Banning ransom payments without fixing the root vulnerabilities is like offering heart transplants to junk food addicts without changing their diet,” he said. “The UK’s proposal risks driving cybercrime further underground while treating symptoms, not causes.
“Unless we tackle the insecure systems and poor cyberhygiene that enable these attacks, we’re applying plasters to a thousand cuts while leaving the knife untouched.”
XSS, or cross-site scripting, is a common form of cyberattack that injects malicious scripts into trusted websites to steal data or hijack user sessions.
The State Department said LockBit had carried out attacks on more than 2,500 victims around the world, including about 1,800 in the United States, and had obtained at least $150 million in ransom payments in the form of digital currency.
Poor Data Infrastructure
Jenkinson said false narratives have suggested that cybercriminals are becoming “more sophisticated” and are all based in countries such as Russia and other former Soviet republics, beyond the reach of the law.Jenkinson pointed to recent attacks perpetrated by Scattered Spider, a group of U.S. and UK hackers that was believed to include a number of teenagers.
“I don’t think the attacks are more sophisticated,” Jenkinson said. According to him, the narrative that cybercriminals are increasingly “sophisticated” is a “get out of jail” statement deployed by corporations and governments to try to explain why the attacks are getting more persistent and more serious.
He said the truth is that the attackers are exploiting basic flaws in most corporations’ security systems. These systems often do not encrypt stored data and use cloud computing servers, which are not secure.
Malik agreed, saying: “The hackers are good, but some of the systems that organizations have here are very poor.
“By and large, most organizations have very poor data infrastructure, very poor systems that allow hackers entry into their system.”
Jenkinson said open source intelligence is being exploited.
“I can look at any organization anywhere in the world, and ... their ... internet-facing assets—their websites, IP addresses and servers—and I can show you if they’re easily hackable or not,” he said.
“The reality is the security teams, the defenders of the realm, aren’t doing their job well enough. AI is definitely being utilized and exploited to identify the gaps.”
Jenkinson said a large part of the problem is over-reliance on commercial cloud server services, which he said have “exposed positions.”
He said that after 9/11, President George W. Bush gave an order that every major technology provider in the United States must allow the National Security Agency (NSA) to have “back door” access to its data.
“So now what you’ve got is cybercriminals exploiting exactly the same gaps that the NSA were exploiting from 2001 onwards, if not before,” he said.
“America suffers around 70 to 80 percent of the world’s cyberattacks,” Jenkinson said. “They are the most reliant country in the world on digital communications for everything, from where you pump your gas in the morning, from when you switch your lights on, everything relies on digital communications through industrial control systems.”
Malik said the consequences of hacking someone’s financial, personal, or medical data can be far-reaching.
“If you receive a letter to say your email address and your home address is now available because someone’s hacked into ‘ABC Limited,’ it might not make much of a difference,” he said.
“But the moment the letter says your national insurance number has been breached, your date of birth, your spouse’s details, your children’s details, a copy of your passport, that is enough information for anyone to impersonate you.
“It’s enough information for someone to try and open a bank account to try and gain credit, and the consequences of this can be far-reaching and severe.”
