FTC chief: Ransomware is the most profitable malware ever devised

(iStock Photo)

The Federal Trade Commission wants you to know its taking ransomware — a specially designed variant of malware that holds data hostage until a payment is received — seriously.

Though ransomware is not new, its viral growth in recent months has opened the door to more advanced campaigns, which now leverage anonymous browsing services, dark market infrastructure and other more complex installation prompts, experts warned during an FTC workshop event intended for businesses leaders, Wednesday.

Ransomware — seen to target a diverse list of victims including, perhaps most notably, the healthcare industry as of late — is the most profitable malware ever devised, FTC Chairwoman Edith Ramirez told an audience of business leaders, government officials and security professionals Wednesday.

An experiment presented at the workshop and conducted by security researchers Joe Malandrino and Anthony Masi showed the average ransomware ransom demands roughly $570 at time of infection, though the price tends to increase when victims delay payment.

At the moment, criminal syndicates and other bad actors are funneling the spoils obtained through ransomware back into research and development efforts, a panel of private sector cybersecurity researchers said.

In the future, ransomware will likely take on a different and more pervasive form due to the growing adoption of internet connected devices across industry, said Georgia Weidman, founder and CTO of Shevirah Inc., a system penetration testing tool developer.

The panel agreed that a rise in anonymous payment systems, like bitcoin, have made it so the financial transaction element of ransomware — an aspect that once held it back in the late 1990s and early 2000s — is vastly more convenient for attackers. Equally, the tactics used to infect computer with ransomware have evolved from bulk spam to spear phishing emails, online advertising laden with malware, social media links and mobile application downloads, said Flashpoint Chief Scientist Lance James.

Barriers that once existed — keeping the average hacker from accessing and then deploying effective ransomware — are lower today than ever before, explained PhishLabs’ Vice President of Threat Research Joseph Opacki. And that’s at least in part due to the increased availability of ransomware-as-a-service and other similar products for sale on the dark web, he said.

Commercial companies that find themselves vulnerable to malware and other exploits must take action to quickly patch flaws given the harm they can pose to consumers. If a knowing company does not rapidly patch a vulnerability then they face violating the Federal Trade Commission Act, said Ramirez, which can call for “monetary redress and other relief for conduct injurious to consumers.”