Ransomware is overhyped - most attacks are small and easily defeated

Masarah Paquet-Clouston (GoSecure), Bernhard Haslhofer (Australian Institute of Technology) and Benoıˆt Dupont (Universite´ de Montre´al), Ransomware payments in the Bitcoin ecosystem, Journal of Cybersecurity, 2019, 1–11, doi: 10.1093/cybsec/tyz003.

Many argue that ransomware authors have proved to be highly innovative in the past years. Since 2013 and the first introduction of the Cryptolocker ransomware, new variants have been designed and distributed by ambitious cybercriminals, building on the success of previous versions or fixing previous errors [3, 15, 18]. Yet, focusing on the speed at which ransomware authors modify their malware and the technologies used may lead to overestimate the severity of the threat. As the current hype would have it, ransomware authors would make large amounts of money—up to millions of dollars—with this successful online black mailing activity [6, 21, 22]. As it is often the case, the reality is not that simple. In 2015, Kharaz, Robertson, Balzarotti et al. [15] published a long-term study on ransomware attacks in which they analyzed 1359 samples from 15 ransomware families. Even though ransomware has evolved, these authors found that the number of families with sophisticated destructive capabilities remains quite small. They also found that malware authors mostly used superficial techniques to encrypt or delete a victim’s files. Flaws were, moreover, found in the code, making the attack easily defeated. Similarly, Gazet [4] conducted a comparative analysis of 15 ransomware and discovered that the code used was often basic and built on high-level languages. Looking at the victims and the ransoms asked, the author concluded that ransomware attackers followed a low-cost/low-risk business model: they did not aim at targeted extortion, but relied instead on small attacks for small ransoms, which could be compensated by mass propagation.