Ransomware encryption to regain traction amid weakening data exfiltration tactics

More ransomware operations are poised to return to encryption-based intrusions following the reduced return on investment of data exfiltration-only attacks, which were sparked by the Clop ransomware gang, SecurityWeek reports.

While Clop obtained payments from over a quarter and nearly a fifth of organizations it compromised in its Accellion and GoAnywhere data theft attacks, respectively, the ransomware group received payments from fewer than 2.5% of those affected by the MOVEit breach and almost none of those impacted by the Cleo and Oracle E-Business Suite hacks, according to a Coveware report. Additional findings revealed higher average ransomware payments despite declining willingness to pay among affected organizations.

"Enterprises are getting educated on the pros and cons of paying a ransom to suppress the release of already breached data. The bullet points on the 'pro' side of the white board are getting increasingly scarce, while the cons side is getting crowded," said Coveware.