Ransomware in the Cyber Crime Ecosystem: An Analysis by the NCSC and NCA

In the digital age, the threat landscape is constantly shifting, with ransomware emerging as a dominant force of disruption. A collaborative white paper by the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA) delves deep into the mechanics, evolution, and business models of ransomware, offering insights into the cyber crime ecosystem.

The journey of ransomware reflects the adaptability of cyber threats. What began as simple screen-locking malware has now evolved into a multifaceted tool of extortion. Modern ransomware not only encrypts victims’ data but also threatens to leak sensitive information, adding a layer of reputational risk to the financial one.

Behind every ransomware attack lies a complex web of activities and actors. The paper meticulously breaks down the cyber crime ecosystem, starting with initial access vectors. These vectors are the entry points for cybercriminals, ranging from direct exploitation of vulnerabilities to brute force attacks targeting weak credentials. Additionally, the roles of stealers and loaders, specialized malware designed to steal credentials and load other malicious payloads, respectively, is key.

Ransomware’s reach is amplified by its distribution methods. Initial access brokers play a crucial role in this phase. These brokers, often operating in the shadows, specialize in gaining unauthorized access to systems and then selling that access to the highest bidder, often ransomware operators. Their services have streamlined the ransomware deployment process, making it more efficient and widespread.

The commercial aspect of ransomware is as varied as its technical one. The white paper delves into several business models, including:

– Buy-a-build: ransomware actors can cheaply buy existing code appealing mainly to smaller groups with limited skills and connections;

– In-house: the same threat group responsible for developing the ransomware conduct much of the attack;

– Ransomware as a Service (RaaS): a modern and increasingly popular model where ransomware infrastructure is rented out, allowing affiliates to launch attacks and share profits with the RaaS provider.

As the threat continues to evolve, so must our understanding and defenses. The collaborative effort by the NCSC and NCA, emphasizes the need for proactive measures in the face of a growing cyber menace.

Source: National Cyber Security Center (2024),  https://www.ncsc.gov.uk/files/White-paper-Ransomware-extortion-and-the-cyber-crime-ecosystem.pdf, (Accessed on 24.04.2024)

Author(s): Livia Di Bernardini – APRE