Looking at cyber extortion (Cy-X) data in Q2 2023

Author: Diana Selck-Paulsson

We then would like to explore the question whether the ecosystem has been growing substantially or if certain groups operate several variants or extortion operations in parallel and thus make the ecosystem seem bigger than it actually is (as we have argued previously). For this we turn to our ransomware map maintained by Orange Cyberdefense’s CERT team, which can be found here. By mapping the leaksites that we call ‘Distinct Count of actor’ in the figure above to the ‘Ransomware operations’ of the Ransomware map, we find that the majority of actors in this field don't seem to operate several leaksites/ operations in parallel. In fact, we are only able to identify 3 operations that are most likely connected to the same threat group that operate 2 leaksites. However, there are two things that are important to bear in mind. First of all, attribution is always difficult. And secondly, for the majority of leaksites/ Ransomware operations/distinct actors that actively named and shamed victim organizations in Q2, we were unable to find a connection to any threat group (see below). This is especially the fact for this year since we added much more new leaksites / operations to our tracking than we have ever before. In fact, we see a lot of movement in this criminal ecosystem right now. While we monitored about 40 unique leaksites in 2022, we have already registered 36 new sites in 2023, and we are only half way through. Most likely, time will show how sophisticated these new operation are and how much we can learn about them.

In Q2, we saw 35 different operations victimizing organizations around the world. Similar to Q1, the top 3 threat actor groups remain unchanged. LockBit3 caused ¼ of all victims in Q2, followed by ALPHV(BlackCat) with 12% and Cl0p causing 9% of all victims. As we mentioned above, Cl0p exploited a vulnerability (again), and thus started exposing victim organizations on their leaksite mid-June. However, of the 188 victims that we are connecting to the MOVEit vulnerability, 89 victims were posted in June, an additional 99 in July, up until the 18^th of July/ the time of writing this blog post.

We observed a small shift in industry distribution, however the top 2 industries impacted by Cy-X remain the same. 1/5 of all victims were from the Manufacturing sector, and Professional Services.

An interesting observation is that the Financial Sector has seen an increase in victims. This can partly be explained by the Cl0p event that has caused around 1/3 of the victims from this sector. When diving into the question who from the Finance sector has been impacted the most, we find that Banks were impacted the most, followed by Insurance Carriers and other financial-related services. Education and Healthcare have also been much more impacted in Q2 than before. Here we observe colleges, universities and schools in general being hit. Within the healthcare sector, we register most victims from the ambulatory and healthcare service or offices of physicians or hospitals. Despite the fact that several threat actors claim to not extort the healthcare sector, and especially hospitals; we see a contradictory trend. In Q2, we observed 8 hospitals in our victim dataset.

We have shown that cyber extortion has significantly grown (again) since the beginning of 2023, but specifically in Q2. The 8% decrease that was observed in 2022 will unfortunately not be a continuous trend. While we observed around 2,100 businesses being victimized in 2022; we have reached already 1,793 victims in the first half of 2023!

Consequently, we do not believe the victim numbers will decrease nor that the threat of cyber extortion is going away anytime soon.

However, there are two things we believe are happening at this moment, or will happen in the near future. Those two observations are made by someone else but we would absolutely agree with them based on the experience we have gained by observing this form of crime for a few years now.

First of all, Chainalysis who just published their mid-year report[1] highlights that ransom payments have unfortunately grown significantly (see below). In H1 2023, the cumulative ransomware revenue has almost reached already the level of all 2022. This sounds very familiar to what we also just realized. Victim numbers are close to the point of the whole last year, ransom revenue follows this trend. This means, we are seeing high volumes this year. High volumes of activity, more threat actors contributing to cyber extortion, many new ‘players’ causing higher volumes of victims. The question remains whether or not the likelihood to pay has increased in the first half of 2023 or if the quantity of victimization makes up for the higher ransom revenue Chainalysis found.

The report explains further that they see that both very small payments and very large payments increased in 2023. For example, in 2023 the ransomware variant Cl0p has had an average payment size of $1,730,486; while other variants such as Dharma only made an average of $265. So again, they see this trend for low and high payments.

The second observation that we also believe is going to happen in the next two months is that we expect threat actors to take vacations. Especially in 2020 and 2021, we saw usually a calmer summer period while by the end of Q3 and all Q4 we registered high volumes of activity. This trend wasn’t continued in 2022, and we believe the war might have ‘interrupted’ the ecosystem in 2022, causing this anomaly.

Like our expectations, we saw a recent tweet from vx-underground[1] asking the LockBit3 group exactly that. According to the tweet, LockBit3 confirms to have taken a summer break (see screenshot).