Ransomware attacks are on the rise, with as many as 1 in 5 people falling victim to infostealer malware infection, according to new research from cybersecurity outfit SpyCloud.

Data from the 2024 SpyCloud Malware and Ransomware Report shows a rise in organisations hit by ransomware at least once, increasing from 81% to 92% over the past year, while those affected more than once saw an even larger jump, from 61% last year to 75% this year.

That has meant a sharp decline in organisations that weren’t hit by ransomware at all, down to just 8% this year, compared to 19% in 2023.

SpyCloud’s report explores the reasons behind this surge in ransomware attacks, revealing that phishing and social engineering continue to be leading threats, accounting for 25% of attacks.

Third-party access was also a significant risk (17%), while stolen cookies enabling session hijacking were ranked as the third most common ransomware entry point (15%).

Last year, SpyCloud claims to have recaptured more than 20 billion cookie records from infostealer malware, averaging 2,000+ records per infected device. 

The company says that leveraging these malware-syphoned session cookies for next-gen account takeover is becoming an increasingly common tactic for cybercriminals.

By analysing recaptured infostealer logs, SpyCloud found that nearly one-third of companies that experienced a ransomware event last year had an infostealer infection in the 16 weeks prior to being attacked.

That’s despite at least 54% of devices infected with infostealer malware having an antivirus or endpoint detection and response solution installed at the time of malware infection.

Notably, the research highlighted a disconnect in cybersecurity perspectives between leadership and security teams, with 91% of leaders generally confident about their organisation’s ability to prevent a full-blown ransomware attack, compared to 54% of security operators, analysts, and incident responders, and 71% of access and identity management professionals. 

The latest ransomware payment figures back up security teams’ concerns.

SpyCloud’s report shows a significant year-on-year increase in the number of organisations paying a ransom, with 62% paying after an attack this year, up from 48% in 2023.

Despite paying their attackers, only a third of businesses fully recovered their data, with 16% achieving partial recovery. On a slightly more positive note, 36% of organisations avoided paying, but still successfully recovered their data.

Recommended reading

• UK Businesses Face New Cyber-attacks Every 44 Seconds in Q2 2024
• Ransomware Crisis Escalating Globally, New Report Shows
• Over Half of Hacked UK Firms Pay Ransom

“With ransomware operators increasingly exploiting infostealer-exfiltrated data like session cookies, it’s become clear that traditional defences are no longer enough,” said Damon Fleury, chief product officer at SpyCloud.

“To disrupt the evolving tactics of ransomware attacks before they escalate, step one is knowing the data criminals have already stolen. Step two is quickly remediating compromised credentials and terminating stolen web sessions, including SSO, VPN, and SaaS application access.”

A study earlier this month found a worrying increase in the number of active ransomware groups, with 56% more ransomware groups conducting attacks around the globe compared to the same period last year, highlighting the importance of adopting multi-layered security policies now.