The average ransomware demand climbed to $1.3 million last year, with more than half of paid ransoms exceeding $1 million, a sharp jump from a decade ago when demands averaged under $1,000, according to a 2016 Symantec report. Attacks tied to Jaguar Land Rover, Marks & Spencer and Asahi last year showed that organizations which refuse to pay still absorb heavy operational and financial damage.
Gavin Millard, vice president of product at Tenable, says the persistence of ransomware has less to do with attacker sophistication than with what defenders leave exposed. "Ransomware attacks are happening at scale and targeting every type of organization, causing a significant amount of business disruption. CISOs are very much focused on trying to mitigate the threat of ransomware, but unfortunately, it's just the monetization of poor cyber hygiene," he said.
That gap is echoed by Etay Maor, vice president of threat intelligence at Cato Networks. "The problem isn't ransomware itself, the problem is everything before that," he said, arguing that response teams still trace most intrusions back to basics nobody fixed. "We're still failing with basic stuff. If you ask detection and response team, they'll tell you that over 80% of attacks are because of a misconfigured security system or an unpatched system."
Enterprise networks have grown far more complex over the past decade, and that complexity multiplies entry points. Cloud infrastructure now underpins daily operations at most organizations, and companies are rolling out AI chatbots and agents faster than security teams can configure them correctly, widening the attack surface with every deployment that skips proper review.
Attackers increasingly skip technical exploits and manipulate employees into doing the work for them. Selena Larson, senior threat intelligence analyst at Proofpoint, points to a technique called ClickFix, which uses fake error or verification pop-ups to trick users into copying and running malicious code themselves. "Social engineering has always been a part of the overall delivery for cybercrime. But now we're seeing things like ClickFix, which is absolutely taking over the landscape in terms of initial access," she said. Because the technique relies on the victim's own hands, it slips past defenses built to catch outside intrusion. "It's pretty unique, because by convincing users to run a script themselves, they're getting users to bypass security controls. The threat actor doesn't really have to do anything except convince somebody to follow these instructions," Larson said.
AI tools cut both ways in this fight. The same systems that help defenders also let attackers generate customized phishing lures and deepfake audio or video impersonating IT staff or executives, lowering the technical bar for less experienced criminal groups to run convincing campaigns.
Millard argues the cycle persists because victims keep funding it. "You should not pay your way out of the fact you didn't have a robust incident and response or disaster recovery plan," he said. "Because all you're doing is enabling attackers to invest more money into making ransomware faster and more scalable."
Leave a Reply