Digital Shadows released its quarterly research report focusing on the latest trends in ransomware. Unfortunately, for vulnerable organizations everywhere, Digital Shadows Photon Research team found that ransomware as a market and community on the dark web has expanded since Q2.

New variants of ransomware, as well as data leak sites (which host and/or advertise stolen information), are popping up every week, including some operated by the notorious Conti ransomware operators. These are the same folks who are suspected to be responsible for Ryuk malware.

A disturbing dimension of this trend is the rise of these data leak sites. While a few major players still dominate market share, the explosion in alternatives – including the Conti-affiliated Netwalker blog, which quickly captured 17% of the market, making it the second most popular blog –  indicates an active community growing in a lucrative business.  

The latest research also highlights that cybercriminals tend to take the path of least resistance. In order to help organizations establish a security posture that presents significant resistance to such bad actors, Digital Shadows also digs into how to track and guard against this increasingly robust and aggressive community.

A few of the findings include:

• In the second quarter of 2020, Maze, DoppelPaymer, and Sodinokibi seemed to rule the ransomware scene with reports of ransomware attacks every day. In Q3 2020, Maze continued to make news headlines; however, more ransomware operators joined in on the data leak site trend. The Photon Research team has been tracking when the data leak websites name specific companies, which indicates they are likely to have been a victim of attacks related to respective variants.

• While Dopple Leaks saw fewer postings in Q3 than in Q2, NetWalker Blog saw an increase in postings. The Conti.News site was identified during Q3 2020, and hit the ground running when they started the site. Other sites accounted for 10% of Digital Shadows’ alerts and consisted of Ako, Avaddon, Ragnar Locker, SunCrypt, LockBit, Mount Locker, and Clop ransomware operators’ data leak sites. 

• Digital Shadows tracks a large number of ransomware dump sites, as you can see above, and has added even more sites since our last update for Q2 2020. Security teams can use this visibility to identify suppliers or third-party vendors referenced on ransomware dump sites.

• In Q2, the team reported that 80% of the Digital Shadows’ intelligence tippers were associated with just three of the ransomware data dump blogs - DoppelPaymer (Dopple Leaks), Sodinokibi (Happy Blog), and Maze (Maze News). In Q3 2020, Maze News, Happy Blog, Conti.News, and NetWalker Blog make up 80% of the alerts published.

• Over time, initial access brokers have enabled ransomware operators by acquiring network access. This service removes the complex process of gaining network access, figuratively unlocking and opening the door for ransomware groups to carry out their attacks.
• A Sodinokibi spokesperson updated an Exploit post in late September 2020, detailing the group’s interest in recruiting more team members, specifically those with penetration testing skills.

For more information, including other findings and trends, please visit https://www.digitalshadows.com/blog-and-research/ransomware-trends-in-q3/