CrowdStrike: Threat actors shifting away from ransomware

Threat actors are shifting away from traditional ransomware and toward malware-free cyber attacks, according to a new report from CrowdStrike.

The cybersecurity vendor this week published its "2023 Global Threat Report," which annually compiles CrowdStrike's research related to cybercrime, or "eCrime," from the previous year. Major topics covered in the 2023 report include malware-free extortion attacks, cloud-related attacks and ongoing geopolitical conflicts.

The vendor observed a 20% increase in the number of threat actors using data theft and extortion without deploying actual ransomware. CrowdStrike illustrated an example of this through Lapsus$, which the vendor refers to as "Slippy Spider."

Lapsus$ gained attention in early 2022 for its extortion-led attacks against Microsoft, Nvidia and others. The attacks primarily involved source code, and it's unknown if any of Lapsus$'s large ransom demands were met, but the gang's "name-and-shame" activity was one of the high-profile examples of extortion-led attacks last year.

Adam Meyers, senior vice president of intelligence at CrowdStrike, told TechTarget Editorial that the rise in extortion speaks to the adaptability of cyber adversaries. He added that while ransom payments were down slightly in 2022, both extortion and ransomware-as-a-service (RaaS) saw significant boosts.

CrowdStrike noted an overall shift away from malware. The vendor said malware-free activity accounted for 71% of its threat detections in 2022, up from 62% in 2021.

"This was partly related to adversaries' prolific abuse of valid credentials to facilitate access and persistence in victim environments," the report read. "Another contributing factor was the rate at which new vulnerabilities were disclosed and the speed with which adversaries were able to operationalize exploits."

Despite the shift away from traditional ransomware deployment, CrowdStrike noted that RaaS networks have proven to be resilient, and warned that affiliated hackers will continue to be a primary threat as they shift from one network to another.

"Even our wins on the security front were tempered by the adversaries' ability to adapt," the report said. "Collaboration between the government and private sector dramatically improved, resulting in the arrest and dismantling of some of the world's most notorious ransomware gangs -- only to see splinter groups recalibrate and flourish."