While 2020 was a difficult year for many, the same can’t be said for cybercriminals, with ransomware attacks surging during the COVID-19 pandemic.

While businesses have been struggling to adapt to the new conditions thrust upon them by the pandemic, ransomware groups were thriving, targeting bigger organisations and demanding more money. We’ve previously written about the COVID-19 pandemic and ransomware, but a new report from the Singapore-based cybersecurity firm Group-IB has shed a disturbing new light on the rise of ransomware in recent months. Their annual Ransomware Uncovered report found that ransomware attacks surged by 150% in 2020, and the average extortion amount doubled. This is due to cybercriminals targeting large organisations judged to be wealthy enough to pay ransoms, and who can’t afford downtime.

The largest pay-out in 2020 was $4.5 million, paid by travel management firm CWT after becoming infected with the RangarLocker ransomware. Other notable victims include foreign currency exchange service Travelex, who forked out $2.3 million to REvil, and the School of Medicine at the University of California, who paid $1.14 million to NetWalker. Massive payments like these are becoming increasingly common, and it’s estimated that ransomware groups made a record $1 billion between 2019 and 2020, the most profitable to date.

Going forward, it’s likely that ransomware groups will start to change tactics, using extortion tactics to get payment. This is in response to an increasingly vigilant business community, who are more prepared for traditional ransomware attacks. The now-disbanded Maze group was a key proponent of this tactic, publishing more than 70 GB of data from Xerox and LG online after they refused to pay their ransom.