From small to small – Newspaper Kommersant No. 35 (7480) dated 03/01/2023

The number of attacks by hackers using ransomware on small and medium-sized businesses increased by more than five times in early 2023, cybersecurity experts say. At the same time, the ideological orientation of the actions of malefactors, which played a significant role in 2022, has given way to traditional extortion. Hackers have become more likely to attack small and medium-sized businesses as large companies that used to be willing to pay a ransom to decrypt files have become more prepared, experts say.

“Kommersant” got acquainted with the data of Kaspersky Lab, according to which the number of attacks by hackers using encryption programs (viruses that encrypt valuable files on the victim’s computers for ransom) increased by more than five times in early 2023. The company did not disclose absolute data, but clarified that small and medium-sized businesses are more often the targets of attacks.

In the fourth quarter of 2022, the number of requests from affected organizations for the restoration of valuable data was already growing, almost doubling compared to the previous quarter, the companies add. In January, the trend continued – in the first month of 2023, the figure has already exceeded half of the requests of the last quarter of 2022. The attacks affected a wide range of organizations, including those providing accounting and cleaning services, supplying building materials, as well as small businesses.

“If at the beginning of last year we observed a shift in the attack vector towards “hacktivism” — inflicting damage for ideological reasons, now the activity of malefactors has become more traditional, when the goal of the attack is a monetary payment,” says Sergey, chief cybersecurity expert at Kaspersky Lab. Golovanov.

The number of incidents involving the use of ransomware ransomware in January and early February increased by almost 90% compared to the same period last year, Fedor Chunizhekov, an analyst at the Positive Technologies research group, confirms. “Already in 2022, ransomware attacks became the most popular type of cyberthreat — they accounted for 2/3 of all incidents,” said Valery Baulin, CEO of Group-IB in Russia and the CIS.

Since the beginning of hostilities in Ukraine a year ago, hackers have been actively exploiting ransomware as a relatively uncomplicated tool for mass attacks throughout the Russian segment of the Internet – “viruses enter the infrastructure through large-scale phishing or through vulnerabilities,” explains the Business Development Director of the Solar JSOC Cyber ​​Attack Center RTK -Solar” Alexey Pavlov. Small and medium-sized businesses have a low level of protection even against basic threats, he emphasizes.

Small and medium-sized businesses became the target of massive cyberattacks back in 2022: already in the second quarter, DDoS attacks (attacks on the server using the “denial of service” model) spread to them. Due to attacks, organizations not only lost profits and customers, but also positions in search results (see Kommersant dated June 21, 2022). On the one hand, such companies do not look like a very attractive target, since the news of a successful attack will not cause much resonance, says Natalya Nazarova, director of the Institute for the Development of Entrepreneurship and Economics. However, she adds, small and medium-sized businesses have more modest resources to ensure cybersecurity, they have a lower level of digital literacy of employees.

Large businesses have become more likely to refuse ransomware to attackers – companies are now better prepared for ransomware attacks, remediation and restoration of performance, says Fedor Chunizhekov. “Smaller organizations are more likely to discuss the possibility of paying for decryption,” he notes.

Tatyana Isakova