mWise Conference 2024 | Kimberly Goody | Google

theCUBE.net

Clips
News
More from mWise Conference 2024

Kimberly Goody

Head of Finacial Crime Analysis, Mandiant

Google

Ransomware attacks surge with skyrocketing ransom demands and executive threats

Ransomware attacks have seen dramatic changes over the past few years. Once considered a mere nuisance, they now pose a potentially devastating threat to organizations of all sizes.Back in 2019, ransomware attacks were just ramping up, focusing on infecting single machines. However, by 2020 and 2021, ransomware became more aggressive, with attacks targeting entire organizations and leading to more widespread damage, according to Kimberly Goody (pictured), head of cyber crime analysis at Google LLC. By 2023, an alarming new trend emerged: although fewer organizations paid ransoms, the median ransom payment skyrocketed from $200,000 to $1.5 million, a shocking seven-fold increase

play_circle_outline Increasing ransomware attacks and payments, with median ransom payment rising to $1.5 million.

play_circle_outline Strategies for combating ransomware attacks, such as implementing multifactor authentication.

play_circle_outline Threat landscape involving personal attacks and threats against executives.

play_circle_outline Collaborations between law enforcement, government, and private sector in tackling cyber threats.

Info
Transcript

Kimberly Goody | Google

Kimberly Goody

Head of Finacial Crime Analysis, Mandiant Google

Insights on ransomware attacks show a significant increase from 2019 to 2021, a decline in 2022, and a resurgence in 2023. Fewer organizations are paying ransoms, but the median payment has increased. Threat actors use tactics like stolen credentials to breach organizations, highlighting the importance of multifactor authentication. Despite defense advancements, threat actors' offensive tactics remain consistent. Collaborative efforts of law enforcement agencies and public-private partnerships are crucial in combating cyber threats. Threat actors are targetin... Read more

explore Keep Exploring

What is the trend in ransom payments for organizations based on data analyzed by chain analysis? add

What are the common methods used by threat actors to compromise organizations and how can organizations proactively combat the use of stolen credentials? add

What type of behavior have you observed from threat actors during incidents where personal attacks or threats are involved? add

What are some examples of positive collaboration between law enforcement and security researchers in preventing cyber attacks? add

bolt Powered by CUBE AI

Kimberly Goody | Google

search

>> Good afternoon, cybersecurity community and welcome back to mWISE. We're here in Denver, Colorado for two days of absolutely thrilling coverage of cybersecurity. I can say already I feel smarter than I woke up this morning. My name's Savannah Peterson. Delighted to be joined by John Furrier. Do you also feel smarter than when you walk up this morning?

>> I'm already smart. I'm just dots. It's all fun. I look old in here, but it's okay.

>> Yeah, that is another story. Forgive the shivers. It's not that we're afraid of cyber crime. It's quite arctic in here. I am really excited about our next guest because she's the head of financial crime at Google. I can only imagine ... Or excuse me, at Mandiant. Let me be specific. Kimberly, your job must be fascinating, intense, full of ransomware. What's it like being you?

>> Yeah, I think waking up every day, you have a plan for what you think you're going to do, and my plan never actually works out that way, just because there's always something that comes up. There's a new threat actor that emerged. There's a threat actor that's changing what they're doing, and my team's job is to really be on top of that. We want to let our customers know before that change manifests in real life that this is something that you need to be prepared for. But it's a super exciting job in terms of always something new, different, and I love that aspect of it.

>> So give us the landscape on ransomware we covered very deeply from an infrastructure standpoint, cyber resilience is a real big part. Recovering from a breach, that's the backup recovery piece, now part of cyber. But there's a whole other level. You're looking at it from a different prism. Give us the stats. What's the landscape look like? What's going on with the actors out there against us? What are some of the stats?

>> Yeah, so let me take you back maybe a couple years, back in, let's say 2019, we're looking at 2020, ransomware attacks against organizations were really ramping up at that time. Prior to that, ransomware was more so considered a nuisance. It was one machine was impacted, you recover that. But then we saw these threat actors charting and compromising these organizations and deploying ransomware widely throughout them, and that had more of a devastating impact. And so that really took off, I would say 2020, 2021. We saw those types of attacks skyrocket. We had a bit of a lull in 2022 because we had a bunch of different events happening. We had the war in Ukraine, which impacted some of these ransomware operations, and threat actors had this mass leak of their private communications. I'm not sure if you've heard about the Conti leaks, but that really caused a lot of threat actors staff to shift and reconstitute. And so in 2022, we saw a decline. And so it was really interesting and we were expecting that that was temporary. That did end up being the case. And we saw in 2023 ransomware reach back up to its prior levels as it was before. And I think some interesting statistics that we're seeing now is an encouraging one, is that less organizations are paying ransoms based on data that chain analysis has analyzed, but we are seeing the median ransom payment increase. And so when they looked at the analysis from the beginning of 2023 to this year, we went from $200,000, that's the median, to 1.5 million. And so that's over seven times increase.

>> That is wild, and in such a short period of time. I'm curious, two questions to follow that up. What do you think led to that increase in extortion? And also, what do you think is giving certain companies the ability to not pay a ransom? Is that they feel confident in their security, or what is that? I'd love for you to unpack it.

>> Yeah, so I think when organizations are deciding whether or not to pay a ransom, often the threat of data leak ends up being one of the major factors for a lot of companies. It's like, "Okay, what did these threat actors actually take from me? Is that sensitive?" When you think about companies that hold ... I'm thinking there was the news about this cancer institution that was compromised, and one of the things that the threat actor was threatening to release was these nude images of these individuals. And if you're thinking about it from an organization standpoint, it's like, "Okay, well I want to protect my victims." My victims meaning my clients in that case. And so there's a lot of thought I think that goes into what kind of data was actually released and what is the value of that data, what are the ramifications if that becomes public? When we talk about the rise in ransom payments, one of the things that I think contributes to that is not just the data leak threat, but also the size of the organizations that are being targeted. And what's really crazy to me is that we had just a couple months ago, reports of this $75 million ransom payment, which to me, that's enormous. That's a lot of money.

>> That's a lot of change, I think to most folks.

>> If your organization is paying in-

>> 75 million, you said? Wow.

>> 75 million. Yes. Yes.

>> What's the stats on consumer business? Obviously higher yield targets with the amount going up. Have their tactics changed. You said they're reconstituting because they got ousted basically and doxxed. What's the current trends on the mechanics of the ransomware attacks, the consumer business, and what's some of the state-of-art moves?

>> I think when we look at attacks and the way that organizations are compromised, that doesn't necessarily change depending on the victim itself. It's very, very common for threat actors these days is to get into organizations initially via stolen credentials. Those stolen credentials can come from so many places, whether that's info stealer malware or phishing pages that are designed to look like that single sign-on login that organizations have, and so they're able to take those credentials. One thing that I would note is with the stolen credentials thing, one way to combat that proactively is by implementing multifactor authentication. And we see more organizations doing that, but it's not foolproof. It's not uncommon that they are like, "Oh, we forgot about that account, and that account didn't have multifactor authentication on." And that's how the threat actor ends up getting in. So the tactics that they're using to break into these organizations, those don't necessarily change. I think some of the calculus in terms of the response might change. Because a smaller organization is going to have less impacted machines. And so when you're evaluating the cost of just starting from fresh, it's not as big for a smaller organization compared to a larger one.

>> On the ransomware specifically, how would you count classify, as Kevin Mandia said, the game is still the same. Any symmetry between offense and defense? Where are we winning? Is there hope? How would you tip the scales or how would you measure the defense side of it? Other areas that people are taking good strides in for being successful, or is it more prescriptive and you don't really know?

>> Yeah, I think one of the things that I find encouraging is not necessarily from the defender's standpoint. We can certainly get into that a bit, but what I think is really great is the activity that we've seen from law enforcement and we've seen-

>> Oh, that's refreshing.

>> Yes, that is great. We mentioned earlier in our panel today, Alan mentioned the stat that we've seen 14 disruptions by law enforcement against these groups this year already, which is amazing. That's incredible. And I think there's definitely been lessons learned from the disruptions that they've had in the past. One of the points that we brought up this morning to compare and contrast is that there are certain, I guess, strategic advantages to doing disruptions at certain times. And I pointed during that panel back to the 2020 disruption against TrickBot that happened in October of that year. And the timing of that from my perspective, wasn't necessarily the best timing from a strategic standpoint because what we were seeing and watching was those threat actors throughout that year were working on developing brand new tools, brand new loaders and back doors that they were going to use to compromise these organizations that they were targeting, and they were working on that. So by the time October came and TrickBot was disrupted, they already had this suite of tools that they could pivot to. And the downside of that was that organizations didn't really have adequate defenses in place for those. They were able to detect TrickBot, they weren't able to detect these new malware. And so then the timing of that was unfortunate, and I think that that's a lesson learned in terms of going forward, what we want the disruption to look like. And LockBit is a great example of activity that occurred this year where they didn't just target the infrastructure or the payments, they also did some initiatives to sow distrust between the threat actors that were running that service and the affiliates. And so I think taking that big multifaceted approach to disruption is really important, and we're seeing some wins there.

>> Love to hear it. Here for all the wins. I'm curious about that law enforcement number. You mentioned 14 acts against threat actors, which is awesome. How does that compare to years previous?

>> That's a great question. I don't know the exact number from years prior. I only can, I guess, speak to my gut feeling is it's definitely ramped up. I think from talking with different law enforcement also during COVID, there was a law in moving forward on some things because a lot of these disruptions are international. So they need to work with their international partners and travel was shut down, so they weren't able to do as much probably during those last couple years. But again, I think it's really picked up. I don't know the percent increase of that though.

>> Either way we see it as a good sign. We like that trajectory. Speaking of interesting things that you brought up. We're talking about ransomware, we think about machines, we think about data. You also mentioned the trend of executive threats, of literal personal threats. Tell me a little bit more about that threat landscape.

>> Yeah, for sure. We definitely have a few threat actors that we track that when we respond to those incidents, we expect them to go above and beyond on the personal attacks or the personal threats. And that might look like contacting the executive's family members to publicize and be like, "Hey, you need to tell your spouse, tell your dad that they need to pay up this ransom." We've also seen cases where a threat actor will make it known to a victim that they know where an executive lives. And then subsequently go into these telegram communities and maybe look for somebody in the area, insinuating that we want somebody to physically go to that address. Now, we haven't seen this really manifest in physical violence against people, but it is a worrying trend, this aggressive next level of harassment that we are seeing. And it's something that people should certainly be aware of so you know how to manage that and also to communicate that to people that, "This is what might happen because it is the threat threat actor, and that's what they're known for."

>> As Kevin says, "Hope for the best, plan for the worst."

>> Yeah.

>> That's the security mindset, which we believe in theCUBE as well.

>> I was going to say, I feel like that goes over a lot of different directions.

>> Yeah. Kimberly, I have to ask you because the crime angle is super important and also fascinating, all people should know about, so thanks for sharing. Public-private partnerships has been a big thing for the past decade. Can you get an update on the collaboration between law enforcement, government and private sector? Because I'm big on the whole militia thing. If someone lands on our shores, we would probably fight back with troops. Cyber, we have to fend for ourselves in the private sector. So you're seeing a lot more collaboration. We've seen that over the past four years in particular. What's the state-of-the-art relationship look like? Where is it working? Where's the areas of improvement? How would you frame the ... Because we want to get authorities involved. That's the key. What's your reaction to that?

>> Yeah, I think there's certainly a lot of positives. So I can speak abstractly to some wins that I've seen. I've seen cases where law enforcement is able to proactively share new malware that's being developed with security researchers so that they're able to put defenses in place to then defend victims at scale. I've seen cases where, for example, we've tried to reach out to a victim to notify them that, "We're pretty sure that somebody's about to deploy ransomware in your systems." And we're not able to make contact. We've been able to leverage those partnerships to reach out to those organizations. And so I think those collaboration wins are really great. But I think that it's not standardized across the board. It depends on maybe the field office or the agency that you're working on and what your rapport is versus this blanket, "Let's share threat intel in this way with one another."

>> What's your thoughts on trust? Because trust is because if Google contacts me, "Oh my God, is it really Google?" Because I get messages all the time. "Hey, you're in my phone book. Is this John?" Or, "Hey, I haven't seen you in a while." Weird things. Obviously, phishing's phishing. Fear phishing's happening. So users have to now be accustomed to question everything, links. "Here's a resume for a job you might like." Boom, they know you're looking for work, but that's got malware. It's all these things, LinkedIn scraping. There's so many tactics, I could name a zillion of them. But users, who do I trust? What's your thesis on that, and how do you guys look at that? Because you guys are in a good position. You guys secure a lot of the devices. My Gmail, I'm very confident and you guys do a good job with stuff we use, but just in general, if I get a call from Google, "Hey." "I'm like, oh, thanks for calling. Is it really you?" What's your thoughts on that?

>> Yeah, no, for sure. I think trust is really important, and I think events like these are awesome because you get to make personal relationships with more people that you wouldn't otherwise be able to. And it's always better, and I coach my analysts on this too, because there is a lot of sharing between security researchers and I'm like, "Okay, well, do we know somebody that actually knows this person and has met them in real life?" Because it has been the case that people have been tricked before into believing that this is a security researcher when really they're a threat actor. And so I guess my philosophy is I like to verify that somebody that I know knows this person, and that makes me feel generally better. But yeah, you referenced-

>> It's that social proof.

>> We know you now. You're here on theCUBE.

>> Yeah, now you know.

>> She's legit. She's a real person.

>> She really is real.

>> But yeah, I think I've heard funny stories about people trying to do victim notifications, and then the police are calling being like, "Hello, are you the threat actor?" And it's like, "No, we're the security researchers. We're trying to warn you." And-

>> I can see that getting a little confusing. Almost, "How do you know all of these things?"

>> Yes. It is-

>> Yeah, it makes sense.

>> We know all of your postures that have been compromised. We know that these malwares are put on your systems, and it's like, "Okay, well are you?"

>> How could you know this? Yeah, yeah, yeah.

>> Deep fakes, all this new tools of even just ... The innovation helps both sides. Again, and worked on. That's why I'm very curious about the crime side of it and progress.

>> Yeah. No, I think it's super fascinating. You're in such an interesting spot right now, and there's so much cool tech. What has you most excited right now about the future of cybersecurity?

>> Oh, that's a great question. I guess I'll answer this from the perspective of my job and my personal viewpoint versus broad scale.

>> Yeah.

>> I obviously have a more narrow focus. But I think when I think about the work that analysts spend time ... Things that they do on a day-to-day basis that aren't things that maybe elicit the most value, there are more important things that they could be doing. Some of that involves summarizing. And so I think looking at AI and how that might be able to help us scale our operations and what we're able to cover. Because to be honest, we are expected to cover everything. I will tell you, it is impossible to cover everything. And so anything that can help us in the way of scale is awesome. And I love to see the innovations that we're having internally in that direction.

>> Oh, it's good. A little bit of hope. A little beacon of AI hope, especially coming from Mandiant. It's a good sign. You guys are the best of the best. Wow. Kimberly, this has been awesome. Thank you so much for taking the time on a very busy day for you at quite a busy event. We appreciate it. And John, thank you as always for the insightful questions, and thank all of you for tuning in to our fantastic two days of coverage here at mWISE in Denver, Colorado. My name is Savannah Peterson. You're watching theCUBE, the leading source for cybersecurity news.