New business model for ransomware

Orange Cyberdefense releases its annual report, Security Navigator, which analyzes the evolution and changes in cyber threats. The data, collected between January and October 2020, comes from the 50 billion security events processed by Orange Cyberdefense's 17 SOCs and 11 CyberSOCs worldwide, its epidemiology lab and research center (World Watch), as well as expert reports and benchmark studies. 2020, despite the crisis, was not the year of the great flood of attacks.

Ransomware is an exception, because here the business model in particular has been changed. The general slowdown in the global economy did not have a significant impact on attacker behavior. Cybercriminals used the issue rather quickly and opportunistically. This attempt at deception was quickly abandoned in favor of classic attacks.

"The behavior of attackers during the crisis changed only superficially and temporarily. We also did not see a notable increase in the number of alerts. Rather, we observed a trend toward attacks targeting users, especially via social engineering"explains Matthias Rosche, Managing Director at Orange Cyberdefense Germany.

In 2020, ransomware groups further developed the business model by exploiting not only access to the data, but also its confidentiality: In addition to encrypting their data, companies now have to expect that some of that data will be made public to increase the pressure.