Fame to Fortune: How Ransomware Gangs Are Shifting Strategies – Insights From Black Hat USA 2024

Welcome to the new age of cybercrime, where ransomware gangs are less like random hackers and more like well-oiled machines driving a dark economy. The Black Hat USA 2024 event pulled back the curtain on these digital gangsters, revealing just how sophisticated (and scary!) they’ve become. And if you think they’re only after the big fish, think again. They’re casting their nets wide, and sometimes…

… the ‘victims’ might not be so innocent after all.

Insights from Black Hat 2024: Ransomware Gangs – Organised Crime 2.0?

The Black Hat USA 2024 has laid bare the intricate operations of ransomware gangs, particularly those like Conti, who have transformed cybercrime into a full-fledged business model. Gone are the days of the lone wolves; these groups operate with the precision and ruthlessness of organised crime syndicates, COMPLETE with hierarchies, business divisions, and even customer support!

At this year’s Black Hat, experts highlighted how ransomware groups are now employing tactics eerily like those used by traditional organised crime syndicates. Think of it as the digital version of the mafia – but instead of breaking kneecaps, they break into your network and hold your data hostage. They’ve even got their own ‘code of conduct’ – rules that dictate everything from how to handle negotiations to how to avoid unnecessary attention from law enforcement!

One more chilling insight from the conference was how these gangs are adopting a ‘Cartel Model.’ Just like drug cartels, they’re forming alliances, sharing resources, and sometimes even working together on particularly lucrative jobs. This level of collaboration is bad news for anyone who thinks they can outsmart these criminals by simply strengthening their firewalls!

But here’s where it gets truly disturbing; the rise of Ransomware-as-a-Service (RaaS). At Black Hat, it was revealed that a growing number of these gangs are offering their tools and expertise to the highest bidder. It’s like the eBay of cybercrime – anyone with a grudge and a few Bitcoins can hire a ransomware gang to do their dirty work. This isn’t just a minor escalation; it’s a complete game changer, making it easier than ever for even non-tech-savvy criminals to get into the action!

Talking the Talk: What Cybercriminals Can Teach Us About the Power of Influence

Another eye-opening discussion at the Black Hat 2024 event revolved around how ransomware gangs like Conti communicate and what we can learn from their methods.

These aren’t just random criminals firing off demands; their communication is strategic, calculated, and disturbingly effective. They know exactly how to push the right buttons, playing on fear, urgency, and desperation to get what they want. It’s a masterclass in psychological manipulation, and, oddly enough, there are lessons to be learned from it.

Cybercriminals have honed their communication strategies into an art form. They understand the power of persuasion, using tailored messages that are designed to break down their victims’ resistance. Whether it’s the initial phishing email that tricks someone into clicking a malicious link or the cold, calculated ransom notes that follow, these messages are crafted with precision. They know when to be threatening, when to appear sympathetic, and when to apply pressure—all to push their targets towards a single goal: Paying up.

But here’s the twist: While we’re busy studying their tactics to prevent attacks, there’s also value in flipping the script!

What if businesses adopted some of these communication strategies – not to manipulate, but to better engage with their own customers and employees? It’s about understanding the psychology behind the message, recognising what drives people to action, and using that insight to create more effective, ethical communication. It’s a controversial take, but there’s something to be said about learning from the enemy to better ourselves.

Of course, the ethical lines are clear – this isn’t about adopting underhanded tactics, but rather, about refining our own communication to be more impactful and persuasive. If anything, the way criminals communicate can serve as a stark reminder of how powerful words can be.

The Unspoken Alliance: Businesses and Ransomware Gangs

Bear in mind that these movements are not something brand new. They have happened before, and Conti’s radical approach is merely a continuation of what’s been laid down as groundwork.

One form of indirect cooperation comes through ransom payments. We’ve discussed how these ransomware gangs would love to feast on large organisations, and what better dish could be served to these cybercriminals than targeting cyber insurance companies? For example, in 2019, CNA Financial paid a massive USD $40 million ransom, largely covered by insurance. According to Bloomberg’s sources, CNA initially disregarded the attackers’ demands but began negotiations a week after the initial breach. By then, the threat group had upped their ransom demand to USD $60 million!

Another notable case is CWT Global in 2020. This US-based travel management company was hit by a ransomware attack and paid USD $4.5 million to the Ragnar Locker gang to regain access to their data! The payment was made after negotiations conducted via a publicly accessible chatroom, revealing the company’s preference to resolve the situation quickly and quietly, with no law enforcement attached! Although some details became public due to the nature of the negotiation, the case highlighted how companies might handle such situations discreetly to avoid bad publicity or prolonged disruptions!

In less transparent jurisdictions, the situation gets much murkier!

There are whispers of businesses allegedly colluding with cybercriminals to avoid more damaging attacks or even target competitors. Ransomware gangs like REvil are also known to offer ‘protection’ services, essentially selling immunity to attacks. Sound familiar?  If you’re thinking what I’m thinking, then yes – this mirrors exactly the traditional mafia tactics, and the fact that these offers are being made suggests that some companies might be tempted to engage with cybercriminals rather than fight them!

Facing these types of situations is not something businesses would be idealised to occur – and that’s stating the obvious! But the fact that there are many businesses that prefer to handle ransomware attacks quietly, negotiating and paying ransoms without involving law enforcement, or even the public, raises concerns not only in terms of the level of our cybersecurity landscape but also our credibility towards the cyberspace virtues!

It’s a troubling trend that raises serious ethical and security concerns.

The Digital Mafias: No Longer the Lightweight League of Lawbreakers

The insights from Black Hat USA 2024 paint a bleak picture of the future of cybersecurity, but they also offer a roadmap for how we can start to fight back!

It’s clear that we need to stop thinking of ransomware gangs as just another cyber threat. They’re organised crime syndicates, and we need to treat them as such. This means more than just beefing up our digital defence; it means addressing the root causes that make these attacks so lucrative in the first place!

But perhaps the most important takeaway is this: We need to be honest about the role businesses might be playing in this cybercrime cartel. It’s time to stop sweeping this issue under the rug and start having real conversations about how we deal with ransomware, instead of succumbing to their damaging demands!

Because as long as there’s money to be made, these digital gangsters aren’t going anywhere.