A new addition has been made to the cyber-rogues’ gallery of ransomware gangs this week. The British Library fell victim to an attack by a criminal group called Rhysida, who have claimed responsibility for the incident. The library has confirmed that personal data stolen in the cyber-attack last month has now appeared for sale online.
Ransomware gangs employ a well-known technique of infecting an organization’s computers with malicious software, rendering them inaccessible, and then demanding a payment, usually in cryptocurrency, to unlock the files. In recent years, these gangs have adopted a tactic known as “double extortion,” where they not only encrypt the files but also steal data and threaten to release it online to strengthen their negotiating position.
Rhysida emerged as the attacker this week by posting low-resolution images of the stolen personal information online and offering it for sale on their leak site. They have set a starting bid of 20 bitcoin, equivalent to about £590,000.
Rafe Pilling, the director of threat research at cybersecurity firm Secureworks, described this attack as a classic example of a double extortion ransomware attack. He explained that the threat of leaking or selling stolen data is used as leverage to extort a payment.
While the British Library is a high-profile victim of Rhysida, this group is also responsible for attacks on government institutions in Portugal, Chile, and Kuwait. In August, they claimed responsibility for an attack on the US hospital group Prospect Medical Holdings.
US government agencies have released an advisory note on Rhysida, stating that this “emerging ransomware variant” has been targeting the education, manufacturing, IT, and government sectors since May. The agencies have also observed Rhysida running a “ransomware as a service” (Raas) operation, where they rent out their malware to other criminals and share the ransom proceeds.
Rhysida is a relatively new name in the public eye, but according to Secureworks, it has emerged from a criminal operation established in 2021 called Gold Victor. Criminal gangs often undergo rebranding exercises, especially when their existing “brand” becomes too notorious and attracts unwanted attention from law enforcement.
The exact identity of the Rhysida gang is unknown, but Pilling assumes that they follow the pattern of similar operatives who are usually from Russia or members of the Commonwealth of Independent States.
Gangs using Rhysida ransomware have employed common access techniques such as exploiting organizations’ virtual private networks (VPNs) or using phishing attacks to trick victims into downloading malicious software or revealing sensitive information.
According to Secureworks, the dwell time for attacks, which refers to the period cybercriminals spend lurking in a system, has decreased to less than 24 hours for cybergangs in general, compared to over four days in 2022. This shorter dwell time helps them avoid detection.
Cryptocurrency, particularly bitcoin, is a popular form of ransom demand for Rhysida attackers and other ransomware gangs. Cryptocurrencies are decentralized and transactions can be obscured, making them difficult to trace.
Paying ransom demands in the UK is strongly discouraged but not illegal unless there is suspicion of funding terrorism. The National Cyber Security Centre does not endorse or encourage the payment of ransom demands. Similarly, in the US, the government discourages ransom payments, although an advisory note from the US Treasury in 2020 clarified that it does not have the force of law.
Ransomware payments have been on the rise, with average payments nearly doubling to £1.2 million over the past year, according to British cybersecurity firm Sophos. With this trend, new ransomware “brands” will continue to emerge.