Banning Ransomware Payments - Will It Work? 

In the light of the ever-growing ransomware threat, what would be the impact banning ransomware payments and would it help?

Throughout 2022, ransomware attacks continued to have significant impacts on organisations, with countries such as Australia observing a sharp rise in cyber attacks and damaging data breaches; this is a trend that is expected to continue.

The Australian government is now exploring options to ban companies from making ransomware payments, and it is likely given the strength of the threat, that other countries around the globe will do the same. This raises the question: what impact would this have on organisations and how can such legislation be effectively enforced?

The Impact On Organisations 

Legislation that prohibits the payment of ransoms to cyber-criminals would almost certainly lead to some positive outcomes, particularly in the short-term. The revenue obtained by ransomware groups that are targeting entities in nations that had implemented legislation to ban payments is likely to reduce dramatically in the short to medium term. Companies that may have previously opted to pay a ransom are far more likely to comply with a legal ban to avoid regulatory or law enforcement scrutiny. 

It is likely, however, that ransomware groups would shift to targeting organisations based in nations where legislation does not outlaw payments. However, despite this shift it is unlikely they would be able to earn at the current level so it would have significant financial impacts for all criminal entities involved in ransomware. 

How Can Government Enforce A Ban? 

Most ransomware payments are made in cryptocurrency via a blockchain. The difficulty and costs associated with tracing crypto assets are likely to create enforcement difficulties for both public and private enforcement bodies. 

Recently, however, several steps have been taken to regulate and crack down on illicit cryptocurrency transactions. These actions include anti-money laundering, combating the financing of terrorism (AML/CFT) rules and the seizure of illicit cryptocurrency exchanges. 

Overall, successful implementation and enforcement of a ban on ransomware payments would prove a significant challenge for governments.

Despite the advancements in regulation and law enforcement activity linked to cryptocurrency transactions, there is still a significant lack of oversight when it comes to ransomware payments. 

Reactions & Adaption By Threat Actors 

Hackers and ransomware groups continually demonstrate a capability to adapt to advancements in technology and law enforcement efforts. This observed pattern will almost certainly extend to a ban on ransomware payments. 

One of the more obvious potential pivots by ransomware groups would be to abandon the ransomware model entirely and begin to conduct attacks purely to exfiltrate data to either extort a victim or sell to the highest bidder. They may also revert to ‘direct theft’ operations where they divert payments from company accounts and payment systems. This would allow groups to continue to conduct attacks without ever deploying ransomware or asking for a ransom, bypassing any new legislation completely. 

Alternatively, ransomware groups with appropriate finances and infrastructure may simply shift targeting into geographies where legislation to ban ransomware payments does not exist.

Companies within these geographies that are not subject to regulatory scrutiny are much more likely to be attacked by ransomware groups. While the new legislation may reduce financial income for the groups, the significant reduction in transparency of their activities may indeed work in their favour as trends such as targeting and modus operandi may become harder to track for defenders and law enforcement. 

So What Does This Mean? 

It is clear that while banning ransomware payments may have an impact on the effectiveness of ransomware groups’ operations, the implementation and enforcement of the legislation would be a challenge for governments to achieve. So, although further legislation may lead to an overall reduction in attacks, monitoring and enforcement will remain the real challenge. This means that to support this, alternative methods for effectively combatting ransomware should also be considered. 

One viable solution would be the continuation of offensive action against infrastructure and networks used by ransomware operators, limiting their ability to stage and conduct attacks. Law enforcement and the judicial system should continue to take a strong stance against cybercriminals by shutting down their infrastructure and pursuing their illegal funds.

Similarly, increased regulation of cryptocurrency and cryptocurrency exchanges would help to reduce the profitability of ransomware attacks. Governments would be better able to monitor and regulate the flow of cryptocurrency, which would limit threat actor opportunities to receive and retain funds to reinvest into future attacks.

Increased information sharing and coordination between countries and businesses is also vital to stem the flow of ransomware attacks. Intelligence-sharing initiatives to identify and track ransomware groups, sharing of intelligence by victims, and joint law enforcement actions will prove pivotal in degrading the success of ransomware operations. 

While banning ransom payments would almost certainly be beneficial to some organisations that fall victim to attacks, such legal action may not be the optimal solution at this time. The proven capability and intent by threat actors to develop and adapt to law enforcement changes suggests that we would see ransomware attacks continue even if a ban were to be implemented. 

In the long term, a ban on payments may well prove to be an effective solution but only if it is implemented alongside alternative actions.

Antony Hogg is Senior Cyber Threat Intelligence Analyst at SecAlliance

You Might Also Read:

Negotiating Ransom: To Pay Or Not?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Big British High Street Retailer Attacked
The US Marshals Service Gets Hacked »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ON-DEMAND WEBINAR: Future-proof your security with Secure Access Service Edge (SASE)

ON-DEMAND WEBINAR: Future-proof your security with Secure Access Service Edge (SASE)

Watch this webinar to explore the Security orchestration, automation, and response (SOAR) paradigm, its relationship with organization IT practices, and its role in your security strategy.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Verisec International

Verisec International

Verisec International AB is a Swedish Tech company focused since inception in enabling Trust in Digital Transactions, through the development of proprietary cutting-edge technologies and services.

Professional Information Security Association (PISA)

Professional Information Security Association (PISA)

PISA is an independent and not-for-profit organization for information security professionals, with the primary objective of promoting information security awareness and best practice.

Green Hills Software

Green Hills Software

Green Hills Software is the largest independent vendor of embedded secure software solutions for applications including the Internet of Things.

Deductive Labs

Deductive Labs

Deductive Labs consulting services help customers with their technology, security and automation challenges.

Guardian360

Guardian360

The Guardian360 platform offers unrivalled insight into the security of your applications and IT infrastructure.

4iQ

4iQ

4iQ fuses surface, social, deep and dark web sources to research and assess risks to people, infrastructure, intellectual property and reputation.

Mondo

Mondo

Mondo is the largest national staffing agency specializing exclusively in high-end, niche IT, Tech, and Digital Marketing talent. Areas of expertise include Cybersecurity.

Flexera

Flexera

Flexera is reimagining the way software is bought, sold, managed and secured.

Six Degrees Group

Six Degrees Group

Six Degrees is a specialist managed IT services organisation offering a range of solutions including Managed Security Services.

Henderson Scott

Henderson Scott

Henderson Scott is a provider of award winning IT recruitment services in core technical markets including Cyber & Information Security.

Gallarus Industry Solutions

Gallarus Industry Solutions

Gallarus leads innovation within industrial Manufacturing, Production and Management Systems, including Cyber Security solutions specifically developed to protect against the latest cyber criminality.

KETS Quantum Security

KETS Quantum Security

KETS harnesses the properties of quantum mechanics to solve challenging problems in randomness generation and secure key distribution and enable ultra secure communications.

South East Cyber Resilience Centre (SECRC)

South East Cyber Resilience Centre (SECRC)

The South East Cyber Resilience Centre supports and helps protect SMEs and supply chain businesses and third sector organisations in the region against cyber crime.

Suridata

Suridata

Suridata is committed to helping enterprises secure their valuable data, with automation, accuracy and simplicity.

Binarly

Binarly

Binarly has developed an AI-powered platform to protect devices against emerging firmware threats.

ThreatNG Security

ThreatNG Security

ThreatNG is redefining external attack surface management (EASM) and digital risk protection with a platform of unmatched breadth, depth, and capabilities in thwarting technical and business threats.