|
Hackers have long relied on poor defenses to extort their victims. But companies are improving, and that means hackers are becoming more aggressive.
Victims were able to restore their data from their own backups in about 49.5% of incidents last year that Palo Alto Networks’ Unit 42 incident-response unit worked on, the company said in a March report. That was up from 28% in 2023 and 11% in 2022.
This means hackers are getting frustrated and resorting to destructive threats. Sam Rubin, head of consulting and threat intelligence at Unit 42, said he has seen increasingly aggressive behavior from criminals. In one incident the company recently worked on, he said, attackers destroyed about 250 virtual servers.
“Now, it's like they're going to bring as much pain as possible, so it's going to be unavoidable for [victims] not to pay them something,” said Wendi Whitmore, chief security intelligence officer at Palo Alto.
Other experts have noticed similar trends. Derek Manky, global vice president of threat intelligence with cybersecurity company Fortinet’s FortiGuard Labs unit, said he has seen an increasing use of destructive malware. This has risen sharply since Russia invaded Ukraine, he said, as malware transitions from the battlefield to the internet.
Manky said that wiper malware, which just erases data from systems rather than locks it up, often shows up quickly after its use in Ukraine.
Christopher Ahlberg, chief executive of Mastercard’s Recorded Future threat intelligence business, said he notices more belligerent behavior from hackers.
“[Hackers] will either say they’ll hit destroy—knowing that a lot of companies may not have as good backups as they think, or people will get nervous about how good their backups are—or they’ll proactively destroy things,” he said. —James Rundle
|
