Banning Ransomware Payments - Will It Work? 

In the light of the ever-growing ransomware threat, what would be the impact banning ransomware payments and would it help?

Throughout 2022, ransomware attacks continued to have significant impacts on organisations, with countries such as Australia observing a sharp rise in cyber attacks and damaging data breaches; this is a trend that is expected to continue.

The Australian government is now exploring options to ban companies from making ransomware payments, and it is likely given the strength of the threat, that other countries around the globe will do the same. This raises the question: what impact would this have on organisations and how can such legislation be effectively enforced?

The Impact On Organisations 

Legislation that prohibits the payment of ransoms to cyber-criminals would almost certainly lead to some positive outcomes, particularly in the short-term. The revenue obtained by ransomware groups that are targeting entities in nations that had implemented legislation to ban payments is likely to reduce dramatically in the short to medium term. Companies that may have previously opted to pay a ransom are far more likely to comply with a legal ban to avoid regulatory or law enforcement scrutiny. 

It is likely, however, that ransomware groups would shift to targeting organisations based in nations where legislation does not outlaw payments. However, despite this shift it is unlikely they would be able to earn at the current level so it would have significant financial impacts for all criminal entities involved in ransomware. 

How Can Government Enforce A Ban? 

Most ransomware payments are made in cryptocurrency via a blockchain. The difficulty and costs associated with tracing crypto assets are likely to create enforcement difficulties for both public and private enforcement bodies. 

Recently, however, several steps have been taken to regulate and crack down on illicit cryptocurrency transactions. These actions include anti-money laundering, combating the financing of terrorism (AML/CFT) rules and the seizure of illicit cryptocurrency exchanges. 

Overall, successful implementation and enforcement of a ban on ransomware payments would prove a significant challenge for governments.

Despite the advancements in regulation and law enforcement activity linked to cryptocurrency transactions, there is still a significant lack of oversight when it comes to ransomware payments. 

Reactions & Adaption By Threat Actors 

Hackers and ransomware groups continually demonstrate a capability to adapt to advancements in technology and law enforcement efforts. This observed pattern will almost certainly extend to a ban on ransomware payments. 

One of the more obvious potential pivots by ransomware groups would be to abandon the ransomware model entirely and begin to conduct attacks purely to exfiltrate data to either extort a victim or sell to the highest bidder. They may also revert to ‘direct theft’ operations where they divert payments from company accounts and payment systems. This would allow groups to continue to conduct attacks without ever deploying ransomware or asking for a ransom, bypassing any new legislation completely. 

Alternatively, ransomware groups with appropriate finances and infrastructure may simply shift targeting into geographies where legislation to ban ransomware payments does not exist.

Companies within these geographies that are not subject to regulatory scrutiny are much more likely to be attacked by ransomware groups. While the new legislation may reduce financial income for the groups, the significant reduction in transparency of their activities may indeed work in their favour as trends such as targeting and modus operandi may become harder to track for defenders and law enforcement. 

So What Does This Mean? 

It is clear that while banning ransomware payments may have an impact on the effectiveness of ransomware groups’ operations, the implementation and enforcement of the legislation would be a challenge for governments to achieve. So, although further legislation may lead to an overall reduction in attacks, monitoring and enforcement will remain the real challenge. This means that to support this, alternative methods for effectively combatting ransomware should also be considered. 

One viable solution would be the continuation of offensive action against infrastructure and networks used by ransomware operators, limiting their ability to stage and conduct attacks. Law enforcement and the judicial system should continue to take a strong stance against cybercriminals by shutting down their infrastructure and pursuing their illegal funds.

Similarly, increased regulation of cryptocurrency and cryptocurrency exchanges would help to reduce the profitability of ransomware attacks. Governments would be better able to monitor and regulate the flow of cryptocurrency, which would limit threat actor opportunities to receive and retain funds to reinvest into future attacks.

Increased information sharing and coordination between countries and businesses is also vital to stem the flow of ransomware attacks. Intelligence-sharing initiatives to identify and track ransomware groups, sharing of intelligence by victims, and joint law enforcement actions will prove pivotal in degrading the success of ransomware operations. 

While banning ransom payments would almost certainly be beneficial to some organisations that fall victim to attacks, such legal action may not be the optimal solution at this time. The proven capability and intent by threat actors to develop and adapt to law enforcement changes suggests that we would see ransomware attacks continue even if a ban were to be implemented. 

In the long term, a ban on payments may well prove to be an effective solution but only if it is implemented alongside alternative actions.

Antony Hogg is Senior Cyber Threat Intelligence Analyst at SecAlliance

You Might Also Read:

Negotiating Ransom: To Pay Or Not?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Big British High Street Retailer Attacked
The US Marshals Service Gets Hacked »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Cloud Credential Council (CCC)

Cloud Credential Council (CCC)

The CCC is a leading provider of vendor-neutral certification programs that empower IT and business professionals in their digital transformation journey.

Akin Gump Strauss Hauer & Feld

Akin Gump Strauss Hauer & Feld

Akin is a leading global law firm providing innovative legal services and business solutions to individuals and institutions. Practice areas include Cybersecurity, Privacy and Data Protection.

SecurityMetrics

SecurityMetrics

SecurityMetrics is leader in data security, PCI, and HIPAA compliance solutions

CNCERT/CC

CNCERT/CC

CNCERT is the national Computer Network Emergency Response Technical Team / Coordination Center of China.

Secardeo

Secardeo

Secardeo is a provider of corporate solutions using digital signatures and certificates. Our solutions enable the user transparent end-to-end encryption of e-mails between organizations.

Gulf Computer Services Co (GCSC)

Gulf Computer Services Co (GCSC)

Gulf Computer Services is a major player in the field of networking & Communication solutions for emerging industries such as Internet Services and Information Technology in Saudi Arabia.

Northcross Group (NCG)

Northcross Group (NCG)

NCG provides services to help organizations meet the challenges of regulatory compliance. Our services include support, consultation, tools and accelerators for all parts of an organization.

eSec Forte Technologies

eSec Forte Technologies

eSec Forte Technologies is a CMMi Level 3 certified Global Consulting and IT Security Services company.

DoControl

DoControl

DoControl gives organizations the automated, self-service tools they need for SaaS applications data access monitoring, orchestration, and remediation.

Debevoise & Plimpton

Debevoise & Plimpton

Debevoise & Plimpton LLP is a premier law firm with market-leading practices in areas including Data Strategy & Security.

Nasuni

Nasuni

The Nasuni File Data Platform offers the protection, detection, and recovery of file shares from ransomware attacks or random disasters within minutes.

Assured Clarity

Assured Clarity

Assured Clarity are a global consultancy, specialising in Risk Management and Data Privacy, through Education, Awareness and Training, throughout an organisation.

TrustMe

TrustMe

TrustMe’s integrated platform for business trust and resilience keeps organizations safe, secure, and trustworthy.

AKIPS

AKIPS

AKIPS develops the world's most scalable network and infrastructure monitoring software, delivered as a turn-key software appliance.

Replica

Replica

Replica creates authentic virtual environments that ensure identities and assets are always protected no matter where or what work needs to get done.

DigiGlass

DigiGlass

DigiGlass is a cutting-edge cybersecurity service provider powered by Redington Gulf, a leading technology distributor in the Middle East and Africa.