ALL ABOUT THE BENJAMINS

They want access to personal, financial, or health data in order to sell it on the dark web. For the retail sector, the stolen data from these hacks typically appears on the black market within days of the theft.

Cybercriminals operate behind anonymous peer-to-peer networks, using encryption technologies and digital currencies to hide their communications and transactions.

Depending on the attack type, they may work solo or as part of an organization, but they often have relationships with each other.

• Team Size

  

  

• Resources

  

  

• Sophistication

  

  

• Business Risk

  

  

Provide Ransomware as a service (RaaS), extract ransoms from targets. Usually paid in decentralized currencies / crypto / other digital assets.

Cybersecurity Ventures expects global cybercrime costs to grow by 15 percent per year, reaching $10.5 trillion USD annually by 2025, up from $3 trillion USD in 2015.

WORKING FOR AND WITH GOVERNMENTS

Nation-state attacks are originated and executed by entities working for and with the approval of a government against another government. A true force to be reckoned with, these attackers can cause unparalleled damage. They are often backed by substantial financial, technical, and material resources.

They’ve been known to exfiltrate data, steal sensitive information, and redirect funds as part of national espionage programs. Their goal is to spy on or steal from businesses or governmental bodies in order to further the interests of their nation.

• Team Size

  

  

• Resources

  

  

• Sophistication

  

  

• Business Risk

  

  

Works as an unofficial extension of a federal government, financed by 3rd party contracts or undisclosed state funding.

In the United States alone, the value compromised information due to international hacking is estimated between 25 billion and 100 billion dollars annually.

Global espionage is occurring all around the world, and although the size of the damage varies, the effects are generally the same. China currently receives about 13% of all cyber attacks globally.

SOPHISTICATED AND ALONE

A large number of individuals in the cybercrime world hack computers just because they can. They’re known as Black Hat Hackers or Rogue participants, and they always break into networks and systems with malicious intent. They may also insert malware, conduct ransomware attacks, or steal data like credentials, financial data, or other personal information.

Black hats are motivated by self-serving reasons, such as financial gain, revenge, or simply to spread havoc. Sometimes their motivation might be ideological, by targeting people they strongly disagree with.

Black hat hackers often develop specialties, such as phishing or managing remote access tools. They find their jobs through the dark web, develop and sell malicious software themselves, or work as a contractor through franchises or leasing arrangements.

• Team Size

  

  

• Resources

  

  

• Sophistication

  

  

• Business Risk

  

  

Financial motivation, revenge or simply for entertainment.

Similar to novice attackers, it is hard to trace the total global impact of lone Black Hat hackers, but global cybercrime is expected to grow by 15 percent per year over the next five years, reaching $10.5 trillion USD annually by 2025.

THE THREAT’S COMING FROM INSIDE THE ORG

Insider threats are bucketed into two categories – those who unintentionally make mistakes opening up their organization to attacks, and those who maliciously take advantage of privileged access in effort to harm the company.

In cases when employees turn against employers, the impact can be devastating on a business and their security. Additionally, certain threat actors will infiltrate a workforce, express grievances via criminal activity, or turn insiders towards their cause with the promise of financial reward. This is a malevolent threat, given that the insiders they turn have privileged access. Disgruntled former employees are an especially tempting target for organized cybercriminals looking to gain easier access to an organization.

• Team Size

  

  

• Resources

  

  

• Sophistication

  

  

• Business Risk

  

  

The insider could be disgruntled and looking to exact revenge on their former employer by inflicting maximum pain. They may also be compromised or blackmailed by an outside threat actor using them to help hack your organization.

The latest research from the Verizon 2021 Data Breach Investigations Report, suggests that insiders are responsible for around 22% of security incidents.

Overall, the average global cost of insider threats has increased 31% over the last 2 years, from $8.76 million in 2018 to $11.45 in 2020 and the largest chunk goes towards containment, remediation, incident response, and investigation.

IT’S FUN TO DO BAD THINGS

Novice attackers they are usually younger people who acquire hacking tools built by more talented hackers.

They may often be unsophisticated, highly visible, and impulsive with their attacks. Despite their name and lack of depth of knowledge, many of these threat actors can still be dangerous. Companies that haven't taken basic security precautions are a prime target.

Some novice attackers may also begin to sell their services to others, contracting out their services to larger criminal organizations in an effort to make money off their hobby. They do not always realize the seriousness of the organizations they are contracting for, they’re simply motivated by the entertainment and monetary gain of their “hobby.”

• Team Size

  

  

• Resources

  

  

• Sophistication

  

  

• Business Risk

  

  

May be interested in low-level ransoms or simply doing it for fun.

It’s difficult to quantify the global impact of novice hackers. What we do know is that based off where they reside, these "amateur" hackers often face little or no legal consequences.

WHEN THE BAD GUYS TEAM UP

Cybercriminals intent on conducting a ransomware attack often buy or rent the ransomware code from other cybercriminals who write and deploy the malicious code through an affiliate program. The ransomware operators provide technical leadership and step-by-step instructions on how to launch the attack. Some RaaS setups are even equipped with a platform that allows both parties to view the status of the attack on a real-time dashboard.

These attackers are so brazen that they even advertise their RaaS on the dark web, much like cybersecurity companies promote their services and solutions as pop-up ads on numerous websites.

There are four common RaaS revenue models: monthly subscription for a flat fee; affiliate programs, which are the same as a monthly fee model but with a percent of the profits (typically 20-30%) going to the ransomware developer; one-time license fee with no profit sharing; pure profit sharing.

• Team Size

  

  

• Resources

  

  

• Sophistication

  

  

• Business Risk

  

  

When a RaaS attack is successful, the ransom money is divided between the provider and the attacker. For the involved parties, it’s a quick buck through an attack that’s hard to trace, while the authors of the code rake in even more cash when they roll out these pre-packaged digital schemes to multiple attackers.

The ransomware business model generates a staggering amount of money for cybercriminals. Like we said earlier, RaaS is a business — and business is booming. According to reports, total ransomware costs are expected to exceed $20 billion in 2021. And as cybercrime tends to beget more cybercrime, that’s a figure that will only increase.