Ransomware Consistent with global trends, ransomware remains one of the most disruptive threats to Australian organisations. Ransomware can cripple organisations that rely on computer systems to function by encrypting devices, folders and files and rendering systems inaccessible. At the same time, cybercriminals have moved towards stealing data, including intellectual property and the personal information of employees and customers. The criminals then demand payment in return for decrypting and restoring access to the victim’s network, and not publicly releasing the stolen information. While all Australian organisations should remain alert to the threat of ransomware, top-tier cybercriminals have demonstrated a growing preference for using ransomware to hunt ‘big game’ entities – those they perceive as high profile, high value, and/or those that provide critical services. The preference for big game hunting means that ransomware attacks may have rapid and serious consequences for the Australian community if deployed against essential services or critical infrastructure (see case studies on pages 28, 33 and 34). The increasing trend of data theft, encryption and public shaming reflects the ongoing evolution of ransomware tactics designed to ensure its financial success. The combination of encryption and data theft is known as ‘double extortion’. Organisations who have previously been well-prepared for, or able to recover from, encryption alone are unlikely to be immune to this tactic. Enormous payments have been requested, usually in cryptocurrency, in return for the promise of non-publication of sensitive data. This further demonstrates the value of personal or sensitive commercial information and the willingness of cybercriminals to exploit any opportunity for profit. Victims must now also evaluate the cost of ransom payment against the legal, commercial and reputational consequences of a data breach. ACSC advice on payment of ransom demands The ACSC advises against paying a ransom. Doing so does not guarantee a victim’s files will be restored, nor does it prevent the publication of any stolen data, or it being sold for use in other crimes. Along with increasing the likelihood of a victim being targeted again, each ransom payment also bolsters the viability of the ransomware market and puts other Australian organisations at greater risk. Irrespective of the decision to pay a ransom, all victims are strongly encouraged to report ransomware-related cybercrime and cyber security incidents to the ACSC. Sharing technical and contextual information about an incident helps to protect other potential victims, supports efforts to disrupt criminal operations and enables the ACSC to implement measures to reduce ransomware targeting against Australia. New business models make ransomware available to a broader range of offenders, akin to a criminal franchising arrangement. During the 2020–21 financial year, the ACSC observed an increase in professional syndicates operating ransomware-as-a-service (RaaS), which enables affiliates to use predeveloped ransomware tools to execute ransomware attacks in return for providing a percentage of the profits to the syndicate. This development has contributed to an increase in ransomware globally and enabled the targeting of a wider range of victims. 31