A new threat intelligence report on doxxing, researched by cyber security experts at Kivu, reveals that the majority of attacks occur in the US, with companies in the consumer sector being more likely to fall victim to such an attack.
Doxxing is the deliberate and malicious leaking of stolen data that happens once a ransomware attack has been deployed.
Kivu, a global cybersecurity solutions provider, has documented the active doxxing efforts of eight ransomware groups: Maze, REvil, DoppelPaymer, CL0P, Nephilim, Sekhmet, Mespinoza (PYSA) and RagnarLocker. A full breakdown of ransomware variant targets can be found in the report.
In What Doxxing Victims Reveal About “Targeted Attacks”, Kivu has analyzed the geographic and industry-based metrics of over 140 ransomware victims who were doxxed between February 1, 2020 and May 1, 2020.
During this period, Kivu found that 55% of victims were based in the US, which is a stark departure from several 2019 reports that stated ransomware affects other regions of the world more frequently.
The recent findings suggest this disproportionate representation of US victims is likely the result of (a) more US victims being targeted, (b) more US victims refusing to pay, and (c) the geographic preferences of ransomware’s malware partners becoming more focused on the US in recent years.
Kivu’s analysis of industry-based trends revealed that the most commonly attacked business (30% of all attacks) fell within the consumer sector, which is comprised of non-essential goods and services such as retail, accounting services, and entertainment.
Sectors that theoretically would be considered attractive targets, such as consumer staples (5%), public sector (1%) and technology (7%), were notably underrepresented in the dataset.
Kivu concluded the profiles of doxxed victims demonstrated that companies are not being targeted based on how high profile they are or the kind of data they store, but instead are first and foremost targeted because of a vulnerability in their network.
Commenting on the findings, Lizzie Cookson, associate director at Kivu Consulting, said: “The recent foray into doxxing by threat actors in the ransomware world has given the cyber security industry a unique insight into more granular levels of detail regarding these extortions.
“Typically, we have only been able to glean information on ransomware attacks by what has been reported by the victims, but the lack of self-reporting following these attacks has historically made it difficult to get a clear picture of what the drivers of these attacks are,” she added.
Winston Krone, global managing director at Kivu Consulting, added: “I’m absolutely thrilled with the team at Kivu who have carried out this in depth research which has enabled us to bring this exclusive insight to light and to attain more learnings about the demographics of these threats.
“It is important work that will help instruct our clients’ risk mitigation efforts moving forward and will help us provide more targeted services,” he added.
- 55% of all doxxed victims were located or headquartered in the US, followed by 7% in the UK and 4% in France. The remaining 34% of victims were spread out across the globe.
- Companies that fall under the consumer sector were the most represented in the data at 30%. This was followed by 22% in industrials and 15% in financial services.
- Kivu’s investigation showed that ransomware variants generally do not favour one industry over another – rather, they are likely to deploy more successfully within certain environments, which are industry agnostic.
The full report can be accessed here.