Ransomware Trends in Australia: 2021 to 2022

guest · Aug 4, 2022

August 4, 2022

Executive Summary
Ransomware threat actors continue to adapt and evolve as the number of attacks increase globally. Ransomware trends in Australia have faced a similar trajectory. The expansion of ransomware-as-a-service (Raas) has made ransomware more accessible, despite global law enforcement efforts to disrupt ransomware gangs.

Initial access brokers (IABs) on dark web and special-access forums are essential for ransomware affiliates to gain access into compromised networks. Before the deployment of the ransomware payload, threat actors rely on “precursor malware” for reconnaissance, lateral movement, access escalation, and exfiltration. Organizations can mitigate against ransomware attacks if they are able to identify initial access sales or detect precursor malware on their networks.
Click to expand...

Key Findings

Australia averages 6 reported ransomware attacks per month despite geopolitical events resulting in noticeable declines. In 2021 and 2022 LockBit has been the most prolific gang to target Australia. However, a new Russia-based ransomware group, ALPHV, emerged at the end of November 2021 and quickly became the dominant ransomware gang targeting Australia in 2022.

To conduct a successful ransomware attack, threat actors require remote access to compromised networks. Ransomware affiliates often purchase these accesses on dark web and special-access forums. Affiliates subsequently use “precursor malware” to move laterally through systems, escalate privileges, and deploy ransomware.

Click to expand...

Background
In recent years, ransomware has become a serious threat to most modern, IT-based economies and societies. What sets ransomware apart from other cyber threats such as espionage is its direct harm to society and the availability of affected systems.

In Australia, ransomware attacks have caused significant problems for many organizations: hospitals are unable to access critical patient medical histories, significantly delaying elective surgeries (Eastern Health); telecommunication suppliers are disrupted (Schepisi Communications); casinos are forced to close (Federal Group); sensitive government employee data is stolen (Frontier Software); and television networks are taken offline (Channel Nine). On top of the immediate effects, ransomware incidents also result in lost revenue, mistrust, and frustration.
Click to expand...

This report gives an overview of the ransomware situation in Australia from January 1, 2021 to June 30, 2022. It provides an in-depth, Australia-specific analysis based on a unique data set of past ransomware attacks.

By identifying Australian initial access sold on dark web marketplaces and the early-stage malware targeting Australia, the report articulates how organizations can mitigate against ransomware.
Click to expand...

Log in or Sign up

Ransomware Trends in Australia: 2021 to 2022

guest Guest

Log in or Sign up

Ransomware Trends in Australia: 2021 to 2022

guest Guest

Useful Searches