In this blog we discuss the increasing threat of ransomware and the ransomware prevention strategies that can help organizations mitigate the risk.
According to our annual report, the number of active ransomware groups is up year-on-year, creating a more complex landscape for security professionals to monitor. In this increasingly busy landscape, it becomes even more vital for organizations to actively apply effective ransomware prevention strategies.
With almost a hundred active ransomware groups in 2024 and the average ransom demands increasing by $1 million from 2023, it is not enough for organizations to simply be aware of the gangs out there. They need to start narrowing down the groups that are most likely to impact them based on their activity and victimology, gather intelligence on their capabilities, tactics, techniques, and procedures (TTPs), and apply these learnings to their defensive measures.
Data back up is a crucial defense when it comes to the mitigation of ransomware attacks. Having data backed up in another location allows organizations to restore any encrypted files, negating the need to pay the ransom demanded.
Many organizations and institutions quote the “3-2-1 back up rule” which is a widely adopted set of best practices. This method involves maintaining three copies of data, using two different storage formats, and storing one copy off-site.
This framework not only safeguards against the threat of ransomware, but also ensures data can be quickly restored, allowing operations to return to some normality following a ransomware attack.
In the worst case scenario that an organization has become the latest victim of a ransomware attack, , it’s important that any incident response plans are put into action immediately to ensure the clean up and remediation of the attack is as quick as possible.
As per guidance from the National Cyber Security Centre, an incident response plan should cover five main points:
In all organizations employees are the first line of defense against cyberattacks, including ransomware. With 70 percent of data breaches involving a human element, it’s crucial that cybersecurity awareness training is provided to educate employees on how to identify and avoid cyber threats. When an informed and vigilant employee identifies a potential threat, not only could they prevent a ransomware attack, but they can also know to reach out to IT and cybersecurity teams immediately. Once the relevant department is aware of the incoming threat, they can react, investigate, and warn others in the organization.
Dark web monitoring is one way that organizations can take a more proactive approach to preventing ransomware by identifying warning signs of an imminent attack. For example, this can come in the form of Initial Access Broker (IAB) posts on dark web hacking forums. An IAB is a specific type of cybercriminal whose aim is to exploit vulnerabilities, gain access to a business’ network, and sell it onto other cybercriminals. We regularly observe ransomware associates interacting with Initial Access Broker posts and many groups are known to buy initial access for their attacks. Monitoring these posts can therefore give organizations an early warning that they are the target.
While an IAB post on a hacking forum won’t name the organization they have gained access to, they will use information that makes up the organization’s profile, such as:
Therefore, if an organization spots a post that matches their profile they can begin an investigation into whether they have been compromised, before the ransomware group has had the opportunity to exploit the vulnerability. The Initial Access Broker post will also often provide details of the compromise, providing security teams with a starting point for their incident response.
If an organization has been listed on a ransomware group, the likelihood is that a ransomware attack has already happened and data has been exfiltrated. However, as with any cyberattack, the faster a team can identify the incident the more likely they are to mitigate the damage. Monitoring these listings:
To help prevent ransomware attacks, organizations must monitor ransomware groups to understand their tactics, techniques, and procedures (TTPs). Getting under the skin of a ransomware group and knowing the industries they target, the types of organizations they want to infiltrate, how, and when they are most likely to perform ransomware attacks, gives security teams the power to prepare for attacks.
As well as being prepared, threat intelligence can also aid incident response and remediation. Security teams can use the intelligence to understand where the attack originated and in some cases who the attack is from. Having access to this information allows organizations to monitor the particular ransomware group to ensure security teams have completely eradicated the threat.
The ransomware landscape is continuously changing with more sophisticated attacks and barriers to entry being lowered by the use of AI and RaaS offerings on the dark web. As well as the more traditional methods of preventative steps such as ensuring there are consistent back ups, regular employee training, and detailed incident response plans, dark web monitoring is also a tool that should be considered. As we’ve discussed, dark web monitoring gives security teams the upper hand on ransomware and RaaS groups, and investigators and analysts access to continuously updated intelligence on the latest tactics, known members, and victims, helping to easily identify and mitigate the risk of future ransomware attacks.
Ransomware is malicious software that encrypts a victim’s files or locks their device, then demands a ransom payment for their release. Attackers typically gain access via phishing emails or exploited vulnerabilities, encrypt data across the network, and issue a ransom demand — often threatening to leak stolen data if unpaid.
Ransomware-as-a-Service (RaaS) is a subscription-based business model where ransomware developers sell or lease ready-made ransomware tools to “affiliates” who carry out the actual attacks. It lowers barriers to entry because affiliates don’t need coding skills — they simply pay a fee, deploy the malware via phishing or exploits, and split any ransom profits with the operator.
The 3-2-1 rule means keeping three copies of data, on two storage formats, with one copy off-site. It’s a crucial ransomware defense, allowing organizations to restore clean data without needing to pay a ransom.
This is a significant legal, financial, and operational decision that should involve legal counsel and incident response specialists rather than being made alone. Strong prevention and backup strategies aim to keep organizations from ever facing that choice. Most experts and law enforcement agencies advise against paying, since it doesn’t guarantee data recovery and funds further criminal activity.
An Initial Access Broker (IAB) exploits vulnerabilities to gain network access, then sells that access on to ransomware groups. IAB posts often include identifying details like industry and location, giving organizations an early warning sign if their profile matches.
Ransomware operates through an ecosystem of Initial Access Brokers and RaaS providers interacting with affiliates on dark web forums. This structure has expanded the pool of active ransomware groups by lowering the skill needed to launch an attack.
Attackers typically exfiltrate data before encrypting it, then threaten to leak it publicly alongside the ransom demand. This combination of encryption plus a data-leak threat is known as double extortion, and increases the pressure on the victim to increase the chance of payment.
Monitoring the dark web for Initial Access Broker posts matching an organization’s profile can reveal a compromise before an attack is launched. Ongoing threat intelligence on ransomware groups’ TTPs also helps predict likely targets and timing.
A strong plan covers key contacts across IR, legal, and PR, clear escalation criteria, and a full incident life-cycle process. It should also include a dedicated conference line for incident calls and basic legal and regulatory guidance.
