Australian Authorities Expose Ransomware Gangs and Their Hidden Careers

Groundbreaking research reveals the inner workings of cybercriminal networks targeting Australia and allied nations.

Australian researchers have completed a comprehensive analysis of ransomware criminal groups, providing unprecedented insights into one of the most damaging cybercrime threats of the modern era.

The study, conducted by the Australian Institute of Criminology, examined 865 ransomware attacks across Australia, Canada, New Zealand, and the United Kingdom between 2020 and 2022.

In 2022, ransomware attacks dipped slightly; 309 attacks were perpetrated by 42 ransomware organisations.

The research reveals that ransomware groups typically have surprisingly brief operational lifespans. The median career length for ransomware organizations was just 1.36 years, with only three groups remaining active across all three years studied.

Despite their short careers, these criminal enterprises inflicted significant economic damage on targeted organizations.

Conti emerged as the most prolific ransomware group, conducting 141 attacks during the study period. The group operated across all three years before voluntarily shutting down in mid-2022.

Following closely behind, the various iterations of LockBit collectively orchestrated 129 attacks, demonstrating the evolution and rebranding strategies employed by these criminal networks.

The study identified clear targeting patterns among ransomware criminals. Industrial sector organizations faced the highest risk, with 239 recorded attacks across all four countries.

Consumer goods companies followed with 150 attacks, while real estate, financial services, and technology sectors each experienced over 90 incidents.

Australia alone suffered 135 confirmed ransomware attacks during the three-year period, with the industrial sector consistently ranking as the primary target.

The technology and consumer goods sectors also faced significant threats, particularly in 2021 and 2022.

Ransomware-as-a-Service

A concerning trend highlighted in the research is the rise of Ransomware-as-a-Service (RaaS) operations.

This business model distinguishes core ransomware groups from their commissioned affiliates, creating a sophisticated criminal ecosystem.

Core groups develop malware and manage victim payments, while affiliates handle the actual system compromises and ransom negotiations.

NetWalker was responsible for the greatest number of attacks (n=35).

Notably, in 2020, NetWalker moved to a RaaS model, which may explain this trend.

Groups adopting the RaaS model demonstrated greater longevity and conducted higher volumes of attacks. This professional approach to cybercrime has transformed ransomware from isolated incidents into organized criminal enterprises capable of sustained operations.

The study documented the impact of international law enforcement efforts on ransomware operations.

“Our findings suggest that certain sectors face disproportionate risks and require tailored cybersecurity approaches,” Whelan noted.

Several prominent groups, including NetWalker and REvil, significantly reduced their activities or disappeared entirely following coordinated police actions by US and Russian authorities.

However, the criminal ecosystem proved resilient. As established groups shut down, new organizations emerged to fill the void.

Implications for Cybersecurity

Professor Chad Whelan, lead researcher from Deakin University’s Cyber Centre, emphasized the need for targeted prevention strategies.

The year 2022 saw the rise of groups like Karakurt, ALPHV (BlackCat), and Black Basta, indicating the persistent nature of this threat.

The research recommends sector-specific awareness programs, regular cybersecurity audits, and advanced threat detection systems, particularly for high-risk industries.

The study also calls for enhanced collaboration between government agencies and researchers to improve data sharing and develop more effective disruption strategies.

As ransomware continues to evolve, this groundbreaking research provides crucial intelligence for defending against one of today’s most persistent cyber threats, offering hope for more targeted and effective countermeasures in the ongoing battle against cybercrime.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.