Australian Authorities Expose Ransomware Gangs and Their Hidden Careers

Australian authorities have published a study that analysed 865 ransomware attacks across Australia, Canada, New Zealand and the United Kingdom between 2020 and 2022, revealing that in 2022 there were 309 attacks carried out by 42 ransomware organisations. The research shows that ransomware groups tend to have short operational lifespans, with a median career length of 1.36 years and only three groups active across all three years studied.

Conti emerged as the most prolific, issuing 141 attacks, while the various iterations of LockBit collectively conducted 129 attacks as these networks evolved and rebranded. The study identifies targeting patterns, noting that the industrial sector experienced the highest risk with 239 attacks across the four countries, followed by consumer goods, real estate, financial services and technology sectors.

Australia alone suffered 135 confirmed ransomware attacks in the period, with the industrial sector consistently the primary target, and the rise of Ransomware-as-a-Service modelling is highlighted as enabling affiliates to handle compromises and negotiations. According to the Australian Institute of Criminology, NetWalker led with 35 attacks, and the research also points to actions by international law enforcement reducing activity for some groups such as NetWalker and REvil, while new groups continued to emerge.