Ransomware the most pervasive threat to US critical infrastructure in 2024, says FBI – Source: www.csoonline.com

Despite successful operations against ransomware gangs in 2024, ransomware was still the most pervasive threat to critical infrastructure in the US last year, according to the FBI’s latest Internet Crime Report.

The agency received more than 4,800 cyber threat complaints from critical infrastructure firms in 2024, with the most reported incidents from those providers dealing with ransomware and data breaches. Ransomware reports to the FBI from this sector went up 9% last year compared to 2023.

Covered in the report are all incidents, both from organizations and individuals, reported to the FBI’s  Internet Crime Complaint Center (IC3). For the past five years, IC3 has averaged more than 2,000 complaints every day.

“Last year saw a new record for losses reported to IC3, totaling a staggering $16.6 billion,” the report said. Fraud represented the bulk of reported losses in 2024.

The leading complaint was phishing/spoofing (193,407 complaints), followed by extortion (just over 86,000), and personal data breach (just over 64,800). Business email compromise scams, for example, where a scammer pretends to be a business partner of a firm and asks that the firm change the bank account to which it sends payments to one under the scammer’s control, ranked seventh, just below tech support scams.

Ransomware ranked way below, with 3,156 complaints and an estimated $12.473 million in losses, compared to over $2 billion in business email compromise losses and $70 million in phishing/spoofing losses.

However, the report noted that the ransomware losses don’t include estimates of lost business, lost time, lost files, or the cost of third-party remediation, and, it added, the figures may be low because some organizations don’t report ransomware losses to the FBI.

In addition, the numbers may be understated because they only include incident reports to the IC3, and not ransomware incidents reported to FBI field offices.

Initial attack vectors

Security firm Mandiant’s annual M-Trends report summarizing attacks it investigated around the world, also released on Wednesday, contained additional insights into the state of ransomware.

The most common way organizations were initially breached in 2024 was through exploiting new or unpatched vulnerabilities, the initial infection vector in one-third of investigations, it said. In fact, exploits overtook phishing as the leading initial infection entry point.

However, when it came to ransomware incidents, the most commonly observed initial infection vector, when the vector could be identified, was a brute-force credential attack. These included password spraying, virtual private network (VPN) devices compromised through default credentials, and high-volume Remote Desktop Protocol (RDP) login attempts.

Number of successful attacks rose

The FBI and international law enforcement partners scored some big wins against ransomware gangs last year, including the takedown of the LockBit gang’s infrastructure and exposing its leader. “We dealt a serious blow to LockBit, one of the world’s most active ransomware groups,” the FBI report said at one point. However, there are reports the group is reviving.

Despite these successes, the IC3 recognized 67 new ransomware variants last year. The most reported of these new variants were FOG, Lynx, Cicada 3301, DragonForce and Frag.

Roger Grimes, data-driven defence evangelist at KnowBe4, pointed out in an email to CSO that, despite the FBI’s best substantive efforts to defeat ransomware with real tangible wins, the number of successful ransomware attacks rose, and overall reported losses increased by 33%. “This is despite very robust efforts to combat [them] and far less victims paying the ransom than ever before,” he said. “Is that a victory?”

Fighting ransomware

“The FBI’s report has always gotten the percentage of crimes occurring due to social engineering and phishing wrong,” Grimes added. “They undercount it by a mile.” He pointed out that many of the FBI’s named threats are actually the result of social engineering and phishing.

“Ransomware isn’t how you got compromised,” he added. “It’s the result of you getting compromised, usually due to social engineering and phishing. … If the FBI added up all the threats that happened because of social engineering and phishing it would likely account for 90% of the threats they report.”

Grimes argued that social engineering is involved in at least 70% of all successful data breaches and at least half of ransomware cases, although, he added, exploits due to unpatched software and firmware have been increasing.

“Every other way you could be compromised, added up all together, only accounts for about 10% of ransomware cases. So, clearly the most effective things you could be doing are fighting social engineering and making sure you patch things that are being exploited (using CISA’s Known Exploited Vulnerability Catalog list),” he said.

To fight social engineering attacks, CISOs should implement defense-in-depth policies, technical defenses, and training, he said. “Most people have the right policies and technical defenses, flawed as they may be,” he added. “The best thing most organizations can do to fight ransomware is to do aggressive human risk management and in particular, great security awareness training, including monthly training and simulated phishing.”

Unfortunately, he said, most companies don’t spend 5% of their IT/IT security budget to fight social engineering and patching their software and firmware. “That is exactly why all hackers, malware, and in particular, ransomware, continue to be so successful long-term,” he said.

Resources available

There is a huge number of resources on the internet to help CISOs fight ransomware. A good place to start is with the reports of the Institute for Security and Technology’s Ransomware Task Force, particularly its Blueprint for Ransomware Defense.

Joshua Corman, a member of the institute who focuses on the impact of cyber attacks on lifeline critical infrastructure like hospitals and utilities, found the FBI report alarming. Health care providers are among the top targets of ransomware gangs, he noted.

“It should disturb everybody that some of the most time-sensitive [providers of critical infrastructure], like water and access to emergency care, are also the least prepared to take a punishment” from a cyber attack, he said.

Corman runs a pilot project called UnDisruptable27, aimed at helping providers of life-affecting critical providers become more resilient.

He pointed out that many CISOs may see ransomware as a regulatory or privacy violation covered by insurance, but while insurance may cover that, as well as ransom payments for data and IT recovery, “insurance doesn’t cover loss of life.” Nor, he said, does insurance cover insufficient cash flow a provider may suffer after a cyber attack that leads to its closure.