By the end of 2021, 16% of Russian companies paid ransom to hackers who attacked their business. For comparison, two years earlier, not a single company made a deal with ransomware.
According to Positive Technologies analysts, the business started paying ransoms because of the ransomware boom that began in 2020. As noted in Group-IB, the number of attacks using viruses that encrypt valuable files increased by more than 200% in 2021. Kaspersky Lab noted that from January to July, cryptographers attacked 9200 corporate users in Russia. In turn, hacker attacks have increased due to the development of cryptocurrencies, since, unlike transfers to bank cards, settlements with its help are more difficult to track.
Anton Shipulin, head of Kaspersky Lab's Industrial Cybersecurity Expert Center, is sure that hacker attacks using cryptographers occur more often in industry, and this is the area that pays the most to cybercriminals. At the same time, the size of the ransom varies from hundreds of thousands to tens of millions of rubles.
According to Oleg Skulkin, head of the Group-IB computer forensics laboratory, in two years hackers have attacked not only large corporations, but also representatives of medium and small businesses. On average, the attackers demanded about 3 million rubles ($42,000) from them.
The chief expert of Kaspersky Lab, Sergey Golovanov, added that most large companies refuse to pay and hire experts to respond to the incident. Small organizations agree to the ransom, especially if the requested amount does not exceed the amount of damage from data loss and the cost of restoring it.
A feature of the ransomware hacker approach in Russia is that none of the groups use public websites to host data from victims who have refused to pay the ransom. Also, according to experts, there was not a single open auction where stolen data would be put up for sale. Usually, attackers present evidence directly during negotiations with the victim.
