Conti and LockBit Ransomware Groups Responsible for Major Pandemic-Era Attacks

What's Happening?

Research from the Australian Institute of Criminology has identified two ransomware groups, Conti and LockBit, as responsible for nearly one-third of major ransomware attacks during the pandemic era across four English-speaking nations. The study examined 865 attacks between 2020 and 2022, revealing that Conti conducted 141 attacks before its apparent shutdown in mid-2022. Despite disbanding, leaks of Conti's internal communications have surfaced, indicating ongoing activity. LockBit, with 129 attacks, has also been active, even after arrests of its members. These groups have evolved into ransomware-as-a-service operators, allowing affiliates to perform attacks, increasing their frequency and impact.

Why It's Important?

The findings highlight the significant threat posed by organized ransomware groups, which have adapted to become more efficient and prolific through a service-based model. This evolution allows them to scale operations rapidly, posing a persistent risk to various sectors, including industrial, consumer goods, and technology. The study underscores the need for tailored prevention strategies, such as cybersecurity audits and staff training, to mitigate risks. It also calls for enhanced cooperation between governments, law enforcement, and academia to disrupt these criminal networks, which are described as adaptive and professional.

What's Next?

The report suggests that high-risk sectors should implement advanced detection tools and cybersecurity measures to prevent future attacks. It emphasizes the importance of collaboration among stakeholders to develop effective strategies against ransomware threats. Continued monitoring and research are necessary to understand the evolving tactics of ransomware groups and to protect vulnerable organizations.

Beyond the Headlines

The shift to a ransomware-as-a-service model reflects broader trends in cybercrime, where criminal organizations leverage market-based relationships to enhance their operations. This approach allows them to bypass traditional workforce management, making them more agile and difficult to dismantle. The report highlights the need for innovative solutions to address these challenges and protect against future threats.