Three Reasons Why You Should Never Pay Ransomware Attackers (2024)

Such was the case with the ProLock ransomware strain back in May 2020. As reported by Bleeping Computer at the time, the FBI found that ProLock’s decryptor might corrupt files larger than 64MB. Investigators went on to warn that victims could experience integrity loss of as much as 1 byte per KB for files over 100MB.

It’s instances like ProLock that help to explain why some ransomware victims suffer data loss and corruption even if they paid the attackers and the attackers provide the decryption key.

In our recently published ransomware report, titled Ransomware: The True Cost to Business, nearly half of respondents (46%) who fulfilled their attackers’ demands regained access to their data following payment only to find that some if not all their data was corrupted. Just 51% said that they successfully recovered all their data after paying, with three percent admitting that they didn’t get any of their data back after payment.

Organizations could incur penalties from the U.S. government for paying ransomware actors who may reside or operate out of countries who are subject to U.S. sanctions. The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) made this point clear in an advisory published in October 2020.

The advisory explains that OFAC has included malicious cyber actors including ransomware attackers in its cyber-related sanctions program. The initiative empowers OFAC to impose penalties on U.S. persons who provide material assistance and/or other methods of support to any designated individuals.

Those powers apply even if someone didn’t know that they were dealing with a sanctioned individual beforehand. As quoted from the advisory:

OFAC may impose civil penalties for sanctions violations based on strict liability, meaning that a person subject to U.S. jurisdiction may be held civilly liable even if it did not know or have reason to know it was engaging in a transaction with a person that is prohibited under sanctions laws and regulations administered by OFAC.

It’s therefore possible that organizations could face civil penalties from OFAC for paying malicious cyber actors such as a ransomware group.

Finally, organizations who pay the attackers are sending the message that extortion schemes work on them, a message which malicious actors could use to justify subsequent attacks and extortion attempts.

This fact cuts both ways: first, there’s nothing that says that ransomware attackers must satisfy their end of the agreement after receiving payment. That goes not only for handing over a *functional* ransomware decryptor, but also for deleting a victim’s stolen data was exfiltrated as part of a Double Extortion tactic.

Double Extortion begins when ransomware attackers steal sensitive information before launching the ransomware encryption routine. As usual, the ransomware encrypts the victim’s data and demands payment in exchange for a decryptor. The threat actor puts extra pressure on the victim by threatening to release the exfiltrated data publicly should the victim refuse to pay the ransom demand.

Although data backups are always a good idea for organizations, the Double Extortion tactic makes backups less effective as a primary strategy against ransomware attacks.

Indeed, ZDNet covered a report in which researchers found that some ransomware gangs didn’t always honor their word after receiving a ransomware payment. Threat actors using REvil/Sodinokibi ransomware sometimes approached victims shortly after they had paid the ransom and demanded another payment for the deletion of the exfiltrated information. Other ransomware groups ended up publishing the victims’ data even after receiving a ransom payment.

It’s not always the same malicious actors who strike again, either. We found in our research that 80% of organizations who paid a ransom demand ended up incurring another attack. Close to half (46%) said it was the same attackers that hit them again, while more than a third (34%) informed us that another threat actor might have been responsible for the follow-up infection.

In general, the FBI advises that organizations refrain from paying ransoms because it simply emboldens malicious actors by telling them that extortion works. Those attackers can then justify expanding their operations and continuing to target organizations, making everyone less safe.

The only way forward for organizations is to prevent an infection from occurring in the first place. To do that, they need to invest in an anti-ransomware solution that doesn’t rely on Indicators of Compromise (IOCs), as not every ransomware attack chain is known to the security community. They need a multi-layered platform that uses Indicators of Behavior (IOBs) so that security teams can detect and shut down a ransomware attack chain regardless of whether anyone’s seen it before.

The Cybereason Operation-Centric approach means no data filtering and the ability to detect attacks earlier based on rare or advantageous chains of (otherwise normal) behaviors. Cybereason is undefeated in the battle against ransomware thanks to our multi-layered prevention, detection and response.