GCHQ Boss Says Ransomware Attacks Have Doubled In A Year

Jeremy Fleming, the Director of GCHQ, has said that the number of ransomware attacks on British organisations has doubled in the past 12 months. He also said that these attacks have become increasingly popular among criminals because it was “largely uncontested” and highly profitable for them.

He made his statement on the second day of the Cipher Brief Annual Threat Conference in Sea Island Georgia on October 25th, follow warnings that Russia and China are harbouring criminal gangs that are successfully targeting western governments or firms. 

Ransomware is malware that employs encryption to hold a victim’s information at ransom. Critical data is encrypted so that the organisation cannot access files, databases, or applications. A ransom is then demanded to provide access. It has been used as part of a number of high-profile cyber-attacks in recent years, including the 2017 attack on the NHS and this year of the health service in Ireland

Hackers are using software to lock files on computers before stopping victims from accessing their own data, essentially holding it hostage and demanding money from them. Once they have received ransomware payment, the hackers can then give a decryption key back to the victim so they can regain access. “I think that the reason ransomware is proliferating, we’ve seen twice as many attacks this year as last year in the UK, is because it works. It just pays. Criminals are making very good money from it and are often feeling that that’s largely uncontested,” he told delegates.

GCHQ has declined to give the exact numbers of ransomware attacks recorded in the UK this year or last. However, a recent US Treasury Report disclosed that suspicious ransomware-related transactions in the US over the first six months of this year were worth around $590m. The top 10 hacking groups believed to be behind criminal activity had moved about $5.2bn worth of bitcoin over the past three years, the report said.

Amid growing concerns over China and Russia’s ties to ransomware gangs, Fleming also called for more clarity over the links between criminals and hostile states. “In the shorter term we’ve got to sort out ransomware, and that is no mean feat in itself. We have to be clear on the red lines and behaviours that we want to see, we’ve got to go after those links between criminal actors and state actors”.

“We’ve got to go after those links between criminal actors and state actors, and impose costs where we see that, and beyond that I think we’ve got to make sure that we are doing all we can to de-simplify this and to take as much out of it of the hands of citizens as we can so that they can enjoy living in a safe and secure online world,” Fleming said. He said that it is not “rocket science” to “defend against this sort of stuff...  Back up your data, make sure you’ve got your admin right, sorted out, make sure your passwords are properly protected, work out where your thresholds are, have thought in advance how you would respond if you were approached for ransom, all those sorts of things, it’s just basic stuff,” he said.

Security specialists believe Russian ransomware will continue to expand given the proliferation of cyber hacking tools and crypto-currency payment channels. 

  • In May this year, the then foreign secretary, Dominic Raab, said states such as Russia could not “wave their hands” and say ransomware gangs operating from their territory had nothing to do with them.

Since then, Western nations has sought to increase pressure on Russia. President Biden has raised these issues with Vladimir Putin over the summer and he hinted that the US would be prepared to attack computer servers belonging to the gangs if nothing was done.   

The Cipher Brief:    Standard:    NMAP:      Belfast Telegraph:    Guardian:    Daily Echo:    Verve Times:   

You Might Also Read: 

Cyber Attacks Are The New Cold War:

 

« Facebook Is 'making hate worse'
British Spies Trust Amazon With Their Secrets »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

Assure Technical

Assure Technical

Assure Technical offers a holistic approach to Technical Security. Our expertise and services span across the Physical, Cyber and Counter Surveillance domains.

CERT-IS

CERT-IS

CERT-IS is the national Computer Emergency Response Team for Iceland.

Exatel

Exatel

Exatel is Poland’s leading provider of ICT security services.

Securicon

Securicon

Securicon provides expert consulting for application, system and network security.

Exein

Exein

Exein are on a mission to build the world’s first ecosystem for firmware security so that all different types of firmware are secure around the world.

miniOrange

miniOrange

miniOrange is a cloud and on-premise based identity and access management (IAM) solution provider.

Sistem Integra (SISB)

Sistem Integra (SISB)

SISB provide IT Security Infrastructure & Development, Mechanical & Electrical Services, Fire Safety & Detection Services, Facilities Management & Application Development.

Intertrust Technologies

Intertrust Technologies

Intertrust Technologies is a software company specializing in trusted computing products and services.

Exterro

Exterro

Exterro is a leading provider of e-discovery and information governance software specifically designed for in-house legal, privacy and IT teams at Global 2000 and Am Law 200 organizations.

Votiro

Votiro

Votiro is an award-winning cybersecurity company that specializes in file sanitization, ensuring every organization is safe from zero-day and undisclosed attacks.

ProArch

ProArch

ProArch is a global team of multidisciplinary experts in cloud, infrastructure, data analytics, cybersecurity, compliance, and software development.

Qi An Xin (QAX)

Qi An Xin (QAX)

QAX is a listed company based in China, and a leader in cybersecurity industry, providing new generation enterprise-level and national-level cybersecurity solutions.

Nordic Defender

Nordic Defender

Nordic Defender is the first crowd-powered modern cybersecurity solution provider in the Nordic region.

Cybermindz

Cybermindz

Many cyber security professionals are under sustained and increasing stress. We set about providing direct support to restore and rebuild emotional and cognitive health.

SKADI Cyber Defense

SKADI Cyber Defense

At SKADI Cyber Defense, we specialize in enterprise-grade cybersecurity solutions tailored for small to medium businesses.

GMO Cyber Security

GMO Cyber Security

GMO Cyber Security is an information security company that focuses mainly on vulnerability diagnosis. It is Japan's leading white hat hacker organisation.