A review of attacks and ecosystems
In its current state, the term ransomware doesn’t only refer to encrypting data, but is used to characterize cyberattacks where a financially motivated actor has gained significant control over the victim's assets and exerts pressure to extort money.
This criminal ecosystem is made up of ever-changing groups and individuals who engage in a delicate balancing act, simultaneously seeking public attention and “fame” to attract potential affiliates and maintain their reputation while avoiding too much attention from law enforcement. The actors frequently engage in rebranding, which makes attribution challenging.

When we analyze attack trends within the ransomware ecosystem, we frequently examine the new features introduced by Ransomware-as-a-Service (RaaS) providers to enhance their operational capabilities. These can range from evasion techniques like intermediate encryption mechanisms or restarting in safe-mode to enhanced encryption speeds. Other enhancements include extended extortion tactics, such as data theft and the threat of data exposure, as well as the implementation of stolen data indexing, and compatibility with additional operating systems. Another important development we saw in 2023 was that ransomware versions for Linux became the standard.
Ransomware’s impact on business operations has escalated and reached a peak in 2023, as seen by multiple high-profile attacks including ALPHV’s breach of MGM Resorts International. This particular attack resulted in extensive data theft and significant disruption to business operations, with MGM estimating damage costs at $100 million. In addition, the Australian ports operator DP World experienced a severe ransomware attack that disrupted 40% of the country’s container trade for several days. As reported, this attack did not involve encryption, which underscores the evolving nature of these threats.
This past year saw a notable increase in large-scale ransomware cyberattacks affecting multiple victims, with some incidents impacting hundreds or even thousands of organizations. The CL0P RaaS group exploited a zero-day vulnerability in the GoAnywhere secure file transfer tool, resulting in breaches that affected over 130 organizations. In early June, CL0P exploited a zero-day vulnerability that enabled it to access the MOVEit file-transfer software, which led to the compromise of more than 2,600 organizations. CL0P conducted a similar attack back in 2021 when it exploited zero-day vulnerabilities in Accellion’s legacy File Transfer Appliance to breach the databases of multiple clients. In all these cases the targets were carefully selected on account of a high volume of customers, data quality, and the ability to spread the attack to additional victims.

Notably, CL0P chose not to encrypt victims’ data but threatened to expose or sell it. This extortion strategy can adversely affect even those victims who regularly maintain backups and employ data restoration procedures. It also decreases the chance of detection during the “noisy” encryption phase of an attack and relieves cybercriminals of the burden of managing decryption keys and the associated “customer service” responsibilities related to multiple file decryption.
Zero-day exploits are highly sought after and are traded in a thriving market. The price of zero-day exploits depends on the targeted system and the nature of the vulnerabilities and can range from several thousand dollars to as much as $2.5 million (on mobile platforms). Prices publicly presented by legitimate platforms like Zerodium reflect what’s going on in parallel criminal underground markets. The sellers’ credibility in these markets depends on the reputation established from previous transactions and the deposits used as collateral. In the screenshot below, an underground seller with a substantial history and deposit offers a Windows Local Privilege Escalation (LPE) exploit for sale for $150K (before negotiations). For comparison, you can buy Windows LPE vulnerabilities on Zerodium for $80K.

Zero-day vulnerabilities have limited shelf lives. The more they are exploited, the higher the likelihood of detection and subsequent patching. Unlike adding features to malware, investing in a zero-day vulnerability, whether through purchase or development, represents a recurring cost that must repeat for each campaign and thus has to be covered by the income generated from a relatively short-lived attack.
Whether zero-day exploitation becomes a common practice depends on the direct yield of each attack. Some estimate CL0P could earn $75-100M from the MOVEit attack alone. Estimates of actual ransom payments can be challenging, but it is safe to assume that, at least in some cases, they more than cover the zero-day cost.
After the MOVEit attack, exploitation of zero-day vulnerabilities for ransomware attacks continued. Threat actors associated with CL0P were observed exploiting a zero-day vulnerability within the SysAid IT support software, potentially impacting over 5,000 customers. The company disclosed in an advisory that it became aware of this new vulnerability (CVE-2023-47246) on November 2, but the earliest reports of the exploitation date back to October. Beyond CL0p, Akira and Lockbit, two of the most prolific ransomware actors, have been exploiting a zero-day vulnerability (CVE-2023-20269) in Cisco appliances, enabling attackers to conduct brute force attacks against existing accounts.
Other financially-motivated advanced groups, like DarkCasino, have exploited the WinRAR vulnerability (CVE-2023-38831) to steal from online traders. The suggested price for a WinRAR RCE exploits by Zerodium is $80K. In another incident, the Nokoyawa ransomware was deployed by a financially motivated actor after exploiting a zero-day in the Windows Common Log File System (CLFS) for privilege elevation.
The likelihood of a growing trend in the use of costly zero-day exploits depends primarily on economic considerations. If threat actors are convinced that the potential returns outweigh the investment, we can expect an increase in these types of attacks. Giving in to extortion attempts provides a short-term solution to an immediate crisis, but in the long-term this only emboldens the attackers. Effectively safeguarding against zero-day attacks presents a complex challenge, which emphasizes the importance of implementing robust measures such as endpoint anti-ransomware solutions, Data Loss Prevention (DLP) mechanisms, and Extended Detection and Response (XDR) products.