NAS-ransomware: hoe ransomware-aanvallen tegen NAS-apparaten verschillen van reguliere ransomware-aanvallen

Abstract

Een specifiek type ransomware-aanval richt zich op NAS-apparaten. In deze studie onderzoeken we het verschil tussen deze NAS-ransomware en reguliere ransomware. Uit de resultaten blijkt dat er bij NAS-ransomware andere ransomware-varianten bij de aanval worden gebruikt, dat slachtoffers vaker particulieren zijn en dat het gevraagde losgeld en de financiële schade lager zijn dan bij reguliere ransomware-aanvallen. Daarnaast vonden we een temporeel verband tussen NAS-ransomware-campagnes en de bekendmaking van nieuwe kwetsbaarheden. We sluiten het artikel af met een aantal aanbevelingen om het risico op slachtofferschap van NAS-ransomware te verkleinen, waarbij bewustwording centraal staat.

Double-sided Information Asymmetry in Double Extortion Ransomware

“…The last decade has seen a rapid rise in crypto-ransomware attacks impacting individuals, businesses, charities and public organisations [7,8,11,26,27,31]. Crypto-ransomware, or ransomware for short, is broadly defined as the use of crypto-techniques to encrypt the files of a victim, after which the attackers ask for a ransom to decrypt the files [23,38].…”

“…The criminals can, thus, extort the victim for access to the decryption key and to avoid data leak. Double extortion has been shown to increase the ransom requested and ransom amount paid [24,26]. Specifically, Meurs et al [26] analysed 353 ransomware attacks reported to the Dutch Police and found a significant positive effect of data exfiltration on ransom requested.…”

“…Double extortion has been shown to increase the ransom requested and ransom amount paid [24,26]. Specifically, Meurs et al [26] analysed 353 ransomware attacks reported to the Dutch Police and found a significant positive effect of data exfiltration on ransom requested. In a follow-up study, Meurs et al [25] analysed 429 ransomware attacks reported to the Dutch Police and an Incident Response company.…”

“…To our knowledge, no previous studies have modelled this two-sided information asymmetry of data exfiltration, and analysed how it impacts the profitability of attacks. Most empirical [26] and game-theoretical modeling [19,20] of double extortion ransomware has focused on the extra profits for attackers by conducting data exfiltration and encryption, compared to only data encryption. We address the relationship between the uncertainty of data exfiltration and profitability by analysing a signaling game.…”

Ransomware Economics: A Two-Step Approach To Model Ransom Paid

“…Various sources provide insights into the size of ransomware payments in recent years. An empirical study of ransomware attacks reported to the Dutch Police from 2019 to 2022 indicated an average ransom demand of 720,256 euros, with 21% of victims actually paying the ransom, resulting in financial losses of 433,191 euros [25], as victims have estimated when they reported to the police.…”