Ransom refusals hit attackers where it hurts: 40% revenue drop in 2022 — Chainalysis

Ransomware victims person seemingly had capable of the extortion, with ransomware revenues for attackers plummeting 40% to $456.8 cardinal successful 2022.

Blockchain quality steadfast Chainalysis shared the information successful a Jan. 19 report, noting that the figures don’t needfully mean the fig of attacks is down from the erstwhile year.

Instead, Chainalysis noted that companies person been forced to tighten cybersecurity measures, portion ransom victims person been progressively unwilling to wage attackers their demands.

Total worth extorted by ransomware attackers betwixt 2017 and 2022. Source: Chainalysis.

The findings formed portion of Chainalysis’ 2023 Crypto Crime Report. Last year, gross from ransomware was a whopping $602 cardinal astatine the clip of the 2022 report, which was aboriginal tipped up to $766 cardinal erstwhile further cryptocurrency wallet addresses were identified.

Chainalysis added that the quality of blockchain means that attackers are having an progressively hard clip getting distant with it:

“Despite ransomware attackers’ champion efforts, the transparency of the blockchain allows investigators to spot these rebranding efforts virtually arsenic soon arsenic they happen.”

Interestingly, ransomware attackers resorted to centralized cryptocurrency exchanges 48.3% of the clip erstwhile reallocating the funds — up from 2021’s fig of 39.3%.

Destination of funds leaving ransomware wallets betwixt 2018 and 2022. Source: Chainalysis.

Chainalysis besides noted that mixer protocols specified arsenic the present OFAC-sanctioned Tornado Cash, accrued from 11.6% to 15.0% successful 2022.

On the different hand, money transfers “high-risk” cryptocurrency exchanges fell from 10.9% to 6.7%.

Victims refusing to pay

In insights shared with Chainalysis, menace quality expert Allan Liska of Recorded Future said that the United States Office of Foreign Assets Control’s (OFAC) advisory connection successful September 2021 whitethorn partially relationship for the gross fall:

“With the menace of sanctions looming, there’s the added menace of ineligible consequences for paying [ransomware attackers].”

A statistical investigation carried retired by Bill Siegel, CEO of ransomware incidental effect steadfast Coveware besides suggested ransomware victims are becoming little reluctant to wage up:

Siegel’s probability illustration suggests that ransomware victims person go progressively unwilling to wage their attackers. Source. Chainalysis.

Cybersecurity security firms are besides tightening up their underwriting standards, Liska explained:

“Cyber security has truly taken the pb successful tightening not lone who they volition insure, but besides what security payments tin beryllium utilized for, truthful they are overmuch little apt to let their clients to usage an security payout to wage a ransom.”

Many firms won’t renew policies unless the insured systems are comprehensively backed up, integrate Endpoint Detection and Response information and utilize multi-authentication mechanisms, Siegel noted.

Related: Report: 74% of stolen funds from ransomware attacks went to Russian-affiliated wallet addresses successful 2021

The gross driblet came contempt an detonation successful the fig of unsocial ransomware strains successful circulation, according to information shared by cybersecurity steadfast Fortinet.

However, Siegel explained that portion it looks similar contention successful the ransomware satellite is increasing, galore of the caller strains are being carried retired by the aforesaid organizations:

”The fig of halfway individuals progressive successful ransomware is incredibly tiny versus perception, possibly a mates 100 [...] It’s the aforesaid criminals, they’re conscionable repainting their get-away cars.”

Chainalysis besides explained that the “true totals” for the figures provided successful the study are apt to beryllium overmuch higher due to the fact that not each cryptocurrency code controlled by ransomware attackers has been identified.