More Than 75% of Crypto Ransomware in 2016 Came From the Russian-Speaking Cybercriminal Underground

San Francisco, CA and Woburn, MA – February 14, 2017 – Out of 62 new crypto ransomware families discovered by Kaspersky Lab researchers in 2016, at least 47 were developed by Russian-speaking cybercriminals. These findings and others are included in an overview of the Russian-speaking ransomware underground, conducted by Kaspersky Lab researchers. The review also highlights that small groups with limited capabilities are transforming into large criminal enterprises that have the resources and intent to attack private and corporate targets worldwide.

Crypto ransomware – a type of malware which encrypts its victim’s files and demands a ransom in exchange for decryption – is one of the most dangerous types of malware today. According to Kaspersky Lab telemetry, in 2016 more than 1,445,000 users (including businesses) around the globe were attacked by this type of malware. In the overview, one of the major conclusions is that the increase in crypto ransomware attacks observed in recent years is the result of a very flexible and user-friendly underground ecosystem, allowing criminals to launch crypto ransomware attack campaigns with almost any level of computer skills and financial resources.

Kaspersky Lab researchers identified three levels of criminal involvement in the ransomware business:

• The creation and update of new ransomware families
• The development and support of affiliate programs distributing ransomware
• The participation in affiliate programs as a partner

The first type of involvement requires a participant to have advanced code-writing skills. The cybercriminals who create new ransomware strains are the most privileged members of the ransomware underground world, as they are the ones who create the key element of the whole ecosystem.

On the second level of the hierarchy, there are the developers of the affiliate programs. These are the criminal communities which – with the help of different additional tools, like exploit kits and malicious spam – deliver the ransomware issued by the malware creators.

The partners of affiliate programs are on the lowest level of the whole system. Utilizing different techniques, they help the owners of affiliate programs to distribute the malware in exchange for a share of the ransom received by owners of the program. Only intent, a readiness to conduct illegal actions, and a couple of bitcoins are required for participants of affiliate programs to enter this business.

According to Kaspersky Lab estimations, the overall daily revenue of an affiliate program may reach tens or even hundreds of thousand dollars, of which around 60 percent stays in the criminals’ pockets as net profit.

Moreover, during their research into the underground ecosystem and multiple incident response operations, Kaspersky Lab researchers were able to identify several large groups of Russian-speaking criminals specializing in crypto ransomware development and distribution. These groups may unite tens of different partners, each with their own affiliate program, and the list of their targets includes not only ordinary internet users, but also small and medium-sized companies and even enterprises. Initially targeting Russian and CIS users and entities, these groups are now shifting their attention to companies located in other parts of the world.

“It is hard to say why so many ransomware families have a Russian-speaking origin. What is more important is that we’re now observing their development from small groups with limited capabilities to large criminal enterprises that have resources and the intent to attack more than just Russian targets,” said Anton Ivanov, security researcher at Kaspersky Lab, and the author of the overview. “We’ve seen something similar with financial malware groups, like Lurk. They also started with massive attacks on online banking users, and then evolved into sophisticated groups capable of robbing large organizations, like banks. Sun Tzu said: ‘If you know the enemy and know yourself, you need not fear the result of a hundred battles.’ That’s why we’ve created this overview: ransomware gangs are turning into very powerful enemies, and for the public and the security community, it is really important we learn as much about them as possible.”

Read more about how Russian-speaking underground ransomware ecosystem works on Securelist.com

About Kaspersky Lab
Kaspersky Lab is a global cybersecurity company founded in 1997. Kaspersky Lab’s deep threat intelligence and security expertise is constantly transforming into security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky Lab technologies and we help 270,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.

For the latest in-depth information on security threat issues and trends, please visit:

Securelist | Information about Viruses, Hackers and Spam
Follow @Securelist on Twitter

Threatpost | The First Stop for Security News
Follow @Threatpost on Twitter

Media Contacts:
Sarah Kitsos
781.503.2615
Sarah.Kitsos@kaspersky.com