At least 47 out of 62 new crypto ransomware families discovered by Kaspersky Lab researchers in 2016 were developed by Russian-speaking cybercriminals, more than 1,445,000 users (including businesses) around the globe were attacked by this type of malware.
These and other findings are included in an overview of the Russian-speaking ransomware underground performed by Kaspersky Lab researchers. “The review also highlights that small groups with limited capabilities are transforming into large criminal enterprises that have the resources and intent to attack private and corporate targets worldwide,” the company said in an announcement.
According to its “telemetry,” the company said “in 2016 more than 1,445,000 users (including businesses) around the globe were attacked by this type of malware. In the overview, one of the major conclusions is that the increase in crypto ransomware attacks observed in recent years is the result of a very flexible and user-friendly underground ecosystem, allowing criminals to launch crypto ransomware attack campaigns with almost any level of computer skills and financial resources."
Kaspersky said its lab researchers said they identified three levels of criminal involvement in the ransomware business:
- The creation and update of new ransomware families;
- The development and support of affiliate programs distributing ransomware; and
- The participation in affiliate programs as a partner.
“The first type of involvement requires a participant to have advanced code-writing skills,” Kaspersky said, adding that, “The cybercriminals who create new ransomware strains are the most privileged members of the ransomware underground world, as they are the ones who create the key element of the whole ecosystem.”
“On the second level of the hierarchy, there are the developers of the affiliate programs. These are the criminal communities which – with the help of different additional tools, like exploit kits and malicious spam – deliver the ransomware issued by the malware creators,” Kaspersky said.
Finally, “The partners of affiliate programs are on the lowest level of the whole system. Utilizing different techniques, they help the owners of affiliate programs to distribute the malware in exchange for a share of the ransom received by owners of the program. Only intent, a readiness to conduct illegal actions and a couple of bitcoins are required for participants of affiliate programs to enter this business.”
According to Kaspersky Lab estimates, “the overall daily revenue of an affiliate program may reach tens or even hundreds of thousand dollars, of which around 60 percent stays in the criminals’ pockets as net profit.”
During its research into the underground ecosystem and multiple incident response operations, Kaspersky said its “researchers were able to identify several large groups of Russian-speaking criminals specializing in crypto ransomware development and distribution. These groups may unite tens of different partners, each with their own affiliate program, and the list of their targets includes not only ordinary internet users, but also small and medium-sized companies and even enterprises. Initially targeting Russian and CIS users and entities, these groups are now shifting their attention to companies located in other parts of the world."
“It is hard to say why so many ransomware families have a Russian-speaking origin. What is more important is that we’re now observing their development from small groups with limited capabilities to large criminal enterprises that have resources and the intent to attack more thanjust Russian targets,” Ivanov said. “We’ve seen something similar with financial malware groups, like Lurk. They also started with massive attacks on online banking users, and then evolved into sophisticated groups capable of robbing large organizations, like banks.”
"Sun Tzu said, ‘If you know the enemy and know yourself, you need not fear the result of a hundred battles.’ That’s why we’ve created this overview: ransomware gangs are turning into very powerful enemies, and for the public and the security community, it is really important we learn as much about them as possible,” Ivanov said.
