Fuelled by cryptocurrencies, ransomware was involved in 79 percent of the global cybersecurity incidents in the last 18 months of pandemic, led by Conti and REvil ransomware attacks, a new report by Sophos, a worldwide leader in next-generation cybersecurity. 

Cryptocurrency will continue to fuel cybercrimes such as ransomware and malicious cryptomining and the trend will continue until global cryptocurrencies are better regulated, according to Sophos researchers. 

Over the coming year, the ransomware landscape will become both more modular and uniform, with attack ‘specialists’ offering different elements of an attack ‘as-a-service’ and providing playbooks with tools and techniques that enable different adversary groups to implement very similar attacks.

Some of the most high-profile ransomware attacks of the year involved ransomware-as-a-service (RaaS), including an attack against Colonial Pipeline in the US by a ‘DarkSide’ affiliate.

An affiliate of Conti ransomware leaked the implementation guide provided by the operators, revealing the step-by-step tools and techniques that attackers could use to deploy the ransomware.

“Ransomware thrives because of its ability to adapt and innovate,” said Chester Wisniewski, principal research scientist at Sophos.

“In 2021, RaaS developers are investing their time and energy in creating sophisticated code and determining how best to extract the largest payments from victims, insurance companies and negotiators,” Wisniewski said in a statement. 

During 2021, Sophos researchers uncovered cryptominers such as Lemon Duck and the less common, MrbMiner, taking advantage of the access provided by newly-reported vulnerabilities and targets already breached by ransomware operators to install cryptominers on computers and servers.

The use of multiple forms of extortion by ransomware attackers to pressure victims into paying the ransom is expected to continue and increase in range and intensity, the report noted.

“It is no longer enough for organisations to assume they’re safe by simply monitoring security tools and ensuring they are detecting malicious code,” said Wisniewski.