Ransomware Groups Evolved Tactics and Expanded Extortion in 2022
Summary
DarkOwl reviews ransomware activity in 2022, describing established and emerging groups, shifts toward extortion, and developments including Hive’s takedown and BianLian’s move toward extortion after a free decryptor was released.
Key points
- DarkOwl reports that ransomware complaints decreased in 2022 while victim payouts rose; it cites an IC3 estimate of about $10.2 billion in potential losses from 800,944 complaints.
- The article says groups increasingly used backdoors and extortion, including data theft and business email compromise, as well as encryption.
- LockBit claimed 436 targets in the latter half of 2022; after its attack on SickKids hospital, it released a decryption key and apologized, attributing the attack to an affiliate.
- Hive targeted healthcare organizations and switched its ransomware from Go to Rust in 2022. Its operation appeared shut down after a seizure banner emerged in January 2023.
- The article describes BianLian using backdoors and living-off-the-land techniques; after Avast released a free decryptor, the group reportedly focused more on extortion than encryption.
- Daixin targeted healthcare, encrypting servers and allegedly exfiltrating personal information; CISA issued a sector advisory in October 2022.
- DarkOwl says Royal used callback phishing and threatened to publish stolen data, while several groups were reported to have links to or members from other ransomware operations.
Article Details
- Event Type
- Annual ransomware activity roundup covering established and emerging ransomware groups active in 2022.
- Impact
- The article reports financial and reputational harm to victims, data theft and extortion, and disruption of services, including healthcare services. It cites an IC3 estimate of approximately $10.2 billion in potential losses from 800,944 complaints and reports that manufacturing was the most extorted industry, while Health Care and the Public Health sector received the most ransomware complaints.
Threat Actors
0megaEmerging ransomware group reported to target organizations worldwide using double extortion; no sample of its ransomware variant had been identified and analyzed at the time of writing.BianLianRansomware group reported to target victims using its own toolkit and living-off-the-land techniques, and to have shifted toward extortion after a decryptor was released.Black BastaRansomware group that rose to prominence in 2022; reported to use double extortion and initial access brokers, Qakbot, and Cobalt Strike.BlackCatRansomware group also referred to in the article as AlphaV; reported to be connected to BlackMatter and DarkSide.ContiRansomware group that shut down its official Tor news and negotiation sites in 2022; reporting cited in the article indicates members dispersed to other groups.DaixinRansomware group reported to target the health sector, encrypt healthcare servers, and exfiltrate personally identifiable information.FIN7The article describes Black Basta as possibly having ties to Carabank (Fin7).HiveRansomware group using an affiliate model and repeatedly targeting healthcare organizations; its operation appeared to be shut down in January 2023 after a law-enforcement operation.LockBitRansomware group reported to have claimed 436 organizational targets in the latter half of 2022; released LockBit 3.0 and operated a bug bounty program.RoyalRansomware group reported to use callback phishing impersonating food-delivery or software providers and to threaten publication of stolen data.
Malware
BabukThe group have been active since June 2022 and built their ransomware from leaked source code attributed to Babuk Locker.BianLianBianLian has had infrastructure since December of 2021 and tripled their infrastructure in August of 2022.BlackCatThe BlackCat Ransomware group (AlphaV) who first appeared in later 2021, is thought to have infected more than 60 victims in its first 6 months of operation.ContiThis group also has possible ties to other ransomware gangs such as Conti, REvil, and Carabank (Fin7).Hive ransomwareHive ransomware was first observed in June 2021 and uses an affiliate RaaS model.LockBitThe group released LockBit 3.0 with new capabilities making it harder to identify in June 2022 and notably started their own bug bounty program.QakbotThey specialize in double extortion and have been seen outsourcing tools with the use of initial access brokers, Qakbot, and Cobalt strike.Roy/ZeonRoyal first materialized in January of 2022 and is believed to be made up of actors previously associated with Conti, TrickBot, and Roy/Zeon malware (the group was originally named Zeon).TrickBotRoyal first materialized in January of 2022 and is believed to be made up of actors previously associated with Conti, TrickBot, and Roy/Zeon malware (the group was originally named Zeon).
Tools
Countries
Industries
ConstructionTheir victims include health services, information technology services, education, and construction companies.EducationTheir victims include health services, information technology services, education, and construction companies.Health Care and the Public Health sector(Internet Crime Complaint Center) received the most ransomware attack complaints from Health Care and the Public Health sector; a trend DarkOwl has seen reflected in the victims of the groups detailed below.Information technology servicesTheir victims include health services, information technology services, education, and construction companies.ManufacturingAccording to IBM’s X-Force Threat Intelligence Index, the manufacturing industry was the most extorted in 2022.