Ransomware attacks typically involve: — Criminals - perpetrators responsible for the ransomware attack — Victims - individuals or organisations who have been subject to the ransomware attack — Facilitators – individuals or companies who may facilitate ransom payments For criminals, ransomware is an attractive cyber weapon as it enables them to profit from victims around the world through the demand for payment, sometimes exceeding millions of dollars. Professional facilitators of ransomware payments who assist victims interact with cybercriminals may be committing criminal offences by virtue of these payments and, ultimately, help perpetuate the global criminal economy. For victims, the consequences of ransomware cascade far beyond short-term and financial implications. Depending on the size of a targeted organisation, a ransom may exceed millions of dollars, with secondary financial implications associated with data loss, system restoration and increasing cyber resilience. There may be significant reputational and legal costs resulting from incidents and recovery. It is clear that ransomware is one of the most damaging types of cyber attacks for industry and individuals, which can have severe and long lasting impacts on Australians and their businesses. Types of attacks3 Hack and leak Targeting executives Tailored ransom demands After gaining control of a company’s IT systems, cybercriminals search for sensitive files, which are stolen before systems can be protected and locked. In the event the ransom is not paid, victims are extorted with threats to publish sensitive information, including on the dark web. Cybercriminals have started to directly target top executives. The techniques include emailing them directly with threats and ransom demands, as well as gaining access to their inboxes, files and computers and stealing their organisation’s data which is then used for extortion or blackmail. Cybercriminals trawl through stolen data in preparation for ransomware attacks, often demanding a ransom payment that is the same as the insured amount. By insisting on payment in cryptocurrency, the attacker may remain anonymous and free to attack again. 3. Locked Out: Tackling Australia’s ransomware threat, Cyber Security Industry Advisory Committee, March 2021. RANSOMWARE ACTION PLAN 3