Analysts Predict a Well-Funded and Prolific Ransomware Industry in 2021

Criminals behind ransomware attacks are thinking about ways to improve their business model and analysts say that will soon include establishing a system to enable more tailor-made products of disruption.

“Cybercriminals have discussed, in open forums, proposals to create a venture capital organization or stock market of sorts, where interested parties can finance the development of malware, tools, and frameworks without ever writing a line of code,” reads a report Booz Allen Hamilton released Wednesday providing an outlook on next year’s cyberthreats.

Ransomware is a breed of cyberattack that disseminates malware to encrypt or capture organizations’ data and hold it hostage for a payment. Perpetrators have been menacing hospitals as well as state and local government institutions, and their election infrastructure. The report anticipates they will formalize the commoditization of attack elements that has already taken place and allow for it to further branch out and diversify. 

“Future developments are likely to include custom [ransomware-as-a-service] operations, in which would-be cybercriminals without the technical expertise can commission malware, tools, or even entire frameworks,” the analysts wrote.

Criminals with efficiency in mind will look for ways to target multiple entities at once by working through a shared supply chain, according to the report.

“Further refinement of tactics used by ransomware operators is likely to include threats against third-party data,” it reads. “The truly ambitious cybercriminal may spend the additional time to compromise an entire network of companies, strike all of them at once, and demand a single large ransom payment from the originating company to provide the decryption keys.” 

The health care industry has long been victimized by ransomware attackers due to the inherent urgency of potentially life-or-death situations. The pandemic has made this worse, and has ushered in telemedicine practices that are likely to endure after it abates. Those systems—rich in sensitive patient data—are also likely to be increasingly targeted by ransomware criminals.

“Mass adoption of this technology will lead to new cybercrime focus, with an emphasis on stealing patient data to enable fraud, target health data in ransomware attacks, trick patients in social engineering schemes, and target remote patient monitoring devices,” the report said. “As patients receive care remotely, telemedicine data will also be a significant target for attackers looking to capitalize on the value of critical data stored on managed service providers and local cloud instances.”

The pandemic will also put the shipping industry in attackers’ crosshairs, given increased dependency as major holidays coincide with lock-down periods. And in 2021, it could offer nation-state actors an opportunity to create havoc while avoiding big red lines associated with other sectors.  

“State-aligned adversaries may view the parcel and shipping sector as a particularly valuable social and economic target for possible disruption that falls below a threshold for retaliatory response,” according to the report. “Targeting this sector could be a viable asymmetric choice for adversaries wishing to cause disruption to industries considered less critical than others like energy or telecommunications.”

Other cyber threat trends the report highlighted for 2021 include an increased focus on the integrated development environments for cloud computing, the emergence of smart malware, and the increased attack surface introduced by fifth generation networking for the industrial internet of things.