Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Ransomware gangs are increasingly turning to remote encryption, and that's a huge problem

Lock on Laptop Screen.

Ransomware is constantly evolving, and the next step in its evolution comes in the form of remote encryption.

A new report from Sophos has claimed, remote encryption is a super destructive method of ransomware attack, and it’s growing more popular by the day, with the company’s anti-ransomware CryptoGuard technology detecting a 62% increase, year-on-year, in intentional remote encryption attacks. 

Most of the biggest ransomware operators today, including Akira, ALPHV (AKA BlackCat), LockBit, Royal, and Black Basta, have all deliberately switched on remote encryption for their attacks, Sophos claims.

Hunting weak spots

So what is remote encryption? It’s a form of ransomware in which threat actors leverage a single compromised, unprotected endpoint to encrypt data on other devices connected to the same network, the researchers explained.  

“Companies can have thousands of computers connected to their network, and with remote ransomware, all it takes is one underprotected device to compromise the entire network,” said Mark Loman, vice president, threat research at Sophos, and the co-creator of CryptoGuard.

“Attackers know this, so they hunt for that one ‘weak spot’ - and most companies have at least one. Remote encryption is going to stay a perennial problem for defenders, and, based on the alerts we’ve seen, the attack method is steadily increasing.”

Remote encryption is a major issue because traditional anti-ransomware protection methods don’t work well, the researchers further explained. These tools can’t “see” the malicious files, or their activity, and thus cannot protect them from unauthorized encryption and potential data loss. 

While remote encryption is gaining in popularity today, it’s hardly a new method. In fact, it was a decade ago that CryptoLocker utilized this method with asymmetric encryption. “Since then, adversaries have been able to escalate the use of ransomware, due to ubiquitous, ongoing security gaps at organizations worldwide and the advent of cryptocurrency,” the researchers added.

More from TechRadar Pro

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.