Chainalysis report: Ransomware revenue down

Ransomware attacks were booming in 2020 and 2021. During that period, extortionists stole over $1.5 billion from businesses and individuals. However, the fat years seem to be over for the time being. Like Chainalysis in a recent report notes, ransomware revenue fell to $457 million in 2022. This is surprising given that blackmail attempts increased sharply overall in 2022. Cybersecurity firm Fortinet registered in the first half of the year alone 10,000 confirmed cases.

Chainalysis writes that the fact that sales nevertheless fell is primarily due to the declining willingness of victims to pay the ransom. There are several reasons for this. One lies in the legal consequences that victims have to expect if the payments violate sanctions. That Office of Foreign Assets Control (OFAC) published a corresponding letter in September 2021. Another factor is the tightening of various cyber insurance companies with regard to the use of compensation money for ransom payments.

Coveware CEO Bill Siegel agrees. His company is dedicated to fighting cyber extortion. In 2022, 59 percent of its customers would have refused ransom payments. In addition, the “lifespan” of the attacks was halved from an average of 153 to 70 days.

Business model: ransomware-as-a-service

Another interesting development comes from the distribution of blackmailers. The increased number of attacks implied a motley mix of different actors, writes Chainalysis. In fact, the area is dominated by a small group that allows other cybercriminals (so-called “affiliates”) to use their malware.

In return, the programmers of the ransomware program receive a share of the loot. This business model is called “ransomware-as-a-service”. As Chainalysis notes, cyber criminals use multiple programs from different providers.

If you look at the illegal transaction volumes in the crypto sector, ransomware hardly played a role in 2022. In return, violations of sanctions increased.