Ransomware perpetrators’ increasing focus on Australia is just targeted marketing

All the warnings in the world aren’t going to stop a small business from paying a ransom to recover encrypted files when the alternative is the collapse of the business – and that, one security expert has warned, is why Australia will continue to be increasingly targeted by cybercriminals looking to make a quick buck from the malware.

Ransomware as a service (RaaS), a growing phenomenon that allows perpetrators to rent ransomware-generating engines to target a particular portion of Internet users. Cybercriminals “know that people from certain countries have a high exposure rate [to ransomware],” ESET ANZ senior research fellow Nick FitzGerald told CSO Australia.

“If Australians end up downloading and executing bad code more than others, [perpetrators] might be prepared to pay more to target Australians because they know it has a lot of wealthy people, and because they know there’s a bigger chance of it getting onto machines – which is a higher ROI.”

Ransomware authors have indeed had great success targeting Australian users in recent years, driving the country up the leaderboard to the point where they regularly rank amongst the world’s most frequent ransomware victims. Some 9415 TorrentLocker victims were discovered in one study in late 2014 – putting it second in the world – while a Trend Micro analysis last year found Australia was hit with a flood of TorrentLocker emails that produced a flood of Australian victims – up from a 2013 analysis in which Kaspersky Labs ranked Australia fifth globally.

ESET’s latest security report, Trends 2016: (In) Security Everywhere, highlighted the growing sophistication of ransomware attacks, which have expanded to include mobile devices with recent ransomware such as Lockerpin and Lockdroid.

With so many new threats appearing and businesses focused more on staying in operation than on philosophical arguments about stamping out ransomware by ignoring it, businesses that were actually hit by online nasties were finding it quicker and easier to just pay up – as a Massachusetts police department and a Los Angeles hospital have famously done recently.

“Morally you shouldn’t encourage people by paying up,” FitzGerald said, “but if it means the death of your business – which might include a dozen people – what are people realistically going to do?”

“It’s not an enormous amount of money for someone from a developed Western industrialised economy, and [operational shutdown] is a total calamity so it’s often a no-brainer for people affected by these things to pay up.”

The continuing success rate for malware attacks may also be fuelled by Australia’s relatively large base of small and medium businesses (SMBs), which generally lack the security budgets of larger companies as well as the backup infrastructure and technological knowhow necessary to work around many ransomware infections.

As a result, many businesses are proving ripe territory even for old malware: in January, ESET reported, some 9 percent of Australian malware and 7 percent of New Zealand malware consisted of Bayrob, a family of malware that has been circulating since 2007.

---

With data increasingly being stored in the cloud, it’s critical to be able to evaluate and manage the security of cloud solutions. Dropbox’s Solutions Architect team are teaming up with the Symantec Information Protection group to discuss the latest industry best practices.

Register here for the February 25th webinar on* Managing enterprise cloud security.

Join us at the CSO Perspectives Roadshow in March.

• Hear from International keynote speakers:Robert Lentz, and Graham Cluley,
• A Security Awareness stream
• 18 different interactive Security Exchange discussions

Join CSO for a day of networking with your peers, engaging and discussing topics relevant to you, hearing from some of the top worldwide IT Security leaders in the market and attending the exhibition floor to win some amazing prizes.