How MFA Failures are Fueling a 500% Surge in Ransomware Losses

The cybersecurity threat landscape has witnessed a dramatic and alarming rise in the average ransomware payment, an increase exceeding 500%. Sophos, a global leader in cybersecurity, revealed in its annual "State of Ransomware 2024" report that the average ransom payment has increased 500% in the last year with organizations that paid a ransom reporting an average payment of $2 million, up from $400,000 in 2023. Separately, RISK & INSURANCE, a leading media source for the insurance industry reported recently that in 2023 the median ransom demand soared to $20 million in 2023 from $1.4 million in 2022, and payment skyrocketed to $6.5 million in 2023 from $335,000 in 2022, much more than 500%.

This shocking surge is a testament to the increasing sophistication of cyberattacks and the significant vulnerabilities inherent in outdated security methods. The most significant factor contributing to this trend is a broad reliance on twenty-year-old, legacy Multifactor Authentication (MFA), which is proving entirely inadequate against modern cyberattacks. Moreover, the adoption of Generative AI has enabled cybercriminals to craft remarkably convincing phishing attacks, making them nearly undetectable to even well-trained users. This article explores the reasons behind the rapid increase in average ransomware payments, the shortcomings of legacy MFA, and the need for next-generation MFA solutions.

Three Factors Driving The Increase in Ransomware Payments

1. Better targeting by cybercriminals

In pursuit of ever-increasing ransom payments, cybercriminals have refocused their efforts and tactics to identify and cripple organizations where they can cause the greatest interruption in operations to extract the largest ransom payments. Examples include the $100 million loss by MGM, the billion-dollar-plus loss by Change HealthCare, and the yet-to-be determined losses by CDK Global. Cybercriminals are acutely aware of this economic calculus and leverage it to demand exorbitant sums, knowing that victims are likely to comply to minimize losses. It is a simple yet painful business decision for the victim.

2. Utilization of Generative AI in phishing attacks

Generative AI technologies have revolutionized the way cybercriminals create phishing emails. These tools generate highly convincing and personalized phishing messages free from grammatical and spelling errors that are indistinguishable from legitimate communications. By analyzing vast amounts of data, Generative AI can mimic writing styles, create believable scenarios, and target individuals with precision. These attacks convincingly mimic emails from trusted sources, complete with accurate branding and contextually relevant information. Organizations that rely on employee training as a defense strategy are increasingly seeing diminishing returns for their investment.

3. Outdated Security Practices

Multifactor Authentication (MFA) has been a mainstay of perimeter security for decades, designed to enhance the protection of enterprise networks by requiring multiple forms of verification. However, legacy MFA systems including Knowledge Based Authentication (KBA), One Time Passwords (OTP), and authentication apps, developed twenty years ago, are increasingly inadequate against modern cyberattacks. Legacy MFA has been defeated in the overwhelming majority of successful ransomware attacks. Legacy MFA is now quickly compromised by cybercriminals in the following ways.

• Phishing Attacks: Attackers trick users into providing their MFA credentials through fake login pages or social engineering tactics.
• SIM Swapping: Attackers convince a mobile carrier to transfer the victim's phone number to a SIM card they control, intercepting SMS-based MFA codes.
• Man-in-the-Middle (MitM) Attacks: Attackers intercept communications between the user and the online service, capturing the MFA tokens and using them to authenticate.
• Malware: Malicious software on a user's device can capture authentication tokens, passwords, or keystrokes, allowing attackers to bypass MFA.
• Other Social Engineering: Attackers may manipulate individuals into revealing their MFA credentials or into performing actions that bypass MFA controls.
• Session Hijacking: Attackers gain access to an active session token (e.g., through XSS, CSRF attacks, or session fixation) and use it to bypass MFA. Once they have the session token, they can impersonate the user without needing to re-authenticate.
• Account Recovery Process Exploitation: Attackers exploit weaknesses in the account recovery process to reset the user's MFA settings, often bypassing MFA.

The Case for Implementing Next-Generation MFA

To effectively combat the virtual tsunami of ransomware attacks, organizations must consider phishing-resistant, next-generation MFA technologies. These advanced solutions incorporate a range of sophisticated authentication factors, including biometrics (such as fingerprint and facial recognition making it significantly harder for cybercriminals to replicate or compromise. This is increasingly relevant when considering that the Verizon Data Breach Incident Report consistently reports that more than two-thirds of breaches are the result of compromised credentials and the Cybersecurity and Infrastructure Security Agency (CISA), an agency of the DHS reports that 90% of successful ransomware attacks are the result of phishing attacks.

The Importance of Biometrics

Biometric authentication leverages the unique physical attributes of authorized users such as their fingerprints, facial characteristics, and other traits that are extremely difficult to forge or steal. Biometrics play a crucial role in next-generation Multifactor Authentication (MFA) due to several key benefits and unique characteristics:

• Unlike passwords or tokens, biometric traits are unique to each individual and are extremely difficult to replicate or steal.
• Biometric data is inherently linked to the individual, making it impossible to share or transfer, reducing the risk of credential theft.
• Biometrics eliminate poor passwords practices and helps mitigate risks associated with weak, reused, or compromised passwords, which are common attack vectors.
• Biometrics are immune to phishing attacks since they cannot be easily captured or entered on fake websites.
• Biometrics help reduce fraud by ensuring that the individual accessing the system is indeed who they claim to be, preventing identity theft and unauthorized access.

User Convenience is Essential

Biometrics offers a quick and seamless authentication process, often just requiring a scan or touch, enhancing the user experience. No passwords for users to memorize or dongles to avoid losing. This reduces the burden on users and minimizes errors, lockouts, and helpdesk calls.

• If an MFA solution is easy to use, more users are likely to adopt it. Complex or cumbersome processes deter users from engaging with and supporting organizational security measures.
• Users are more likely to follow security protocols and use MFA consistently if it integrates smoothly into their daily routines without causing disruptions.
• Simplified MFA processes reduce the likelihood of user errors, such as mistyping codes or misplacing tokens. This leads to fewer lockouts and support requests saving time and resources for the organization.
• Convenient MFA contributes to a positive sentiment towards security policies and the IT department. Satisfied employees are more likely to embrace security measures.
• Quick and easy authentication processes ensure that employees can access the resources they need without unnecessary delays, maintaining productivity levels.

In summary, user convenience in MFA solutions is essential to ensure high adoption rates, reduce errors and support costs, enhance security, maintain productivity, and improve overall user satisfaction. By balancing security with ease of use, organizations can create an effective security environment that is both effective and user-friendly.

Choosing the Right MFA Solution

Selecting the appropriate phishing-resistant, next-generation MFA solution requires careful consideration of the organization's unique requirements. Factors to consider include the types of authentication factors supported, integration capabilities, ease of use, and scalability. Organizations should opt for solutions that offer a balance of security, usability, and flexibility.

Implementing next-generation MFA should be approached in phases to minimize disruption and ensure a smooth transition. This phased approach allows for thorough testing and user acclimatization.

The cybersecurity landscape is constantly evolving, and so must an organization's security measures. Continuous monitoring and regular updates are crucial to maintaining the effectiveness of phishing-resistant and next-generation MFA solutions. Organizations should establish a framework for ongoing security assessments, system updates, and threat intelligence integration to stay ahead of emerging threats.

Conclusion

The dramatic rise in ransomware payments is a stark reminder of the evolving cyber threat landscape and the urgent need for improved security measures. The failings of twenty-year-old legacy MFA systems are the leading contributing factor in this alarming trend. As cyberattacks become more sophisticated, specifically with the use of Generative AI to create highly convincing phishing messages, organizations must move beyond outdated security practices and embrace next-generation MFA technologies. By adopting advanced authentication methods, implementing adaptive security measures, and ensuring seamless integration with their security infrastructure, organizations can significantly enhance their defense against ransomware attacks. The transition to phishing-resistant, next-generation MFA is not just a technological upgrade; it is a strategic imperative for safeguarding critical data, reducing the risk of catastrophic financial loss, and ensuring operational resilience in the face of escalating cyber threats. In the battle against ransomware, the message is clear: legacy MFA systems are no longer sufficient.

Learn more about how Token's Next-Generation MFA can stop phishing and ransomware from harming your organization at tokenring.com

This article was originally published on The Hacker News.