Ransomware surge sees hackers demand up to USD $8.6 million
The 12th of May marks the anniversary of the 2017 WannaCry attack that paralysed critical services worldwide, notably disrupting the National Health Service in the United Kingdom. Since then, ransomware has become a household term—albeit one still shrouded in technical complexity for many. Rebecca Moody, Head of Data Research at Comparitech, reflected on the shift, stating, "In 2017, ransomware, to many people, was still a huge unknown. Fast-forward to today, and it's a word within a lot of people's vocabulary—even if they don't understand the technical jargon surrounding it. This is because of large-scale attacks like WannaCry and the current attack on Marks and Spencer, bringing these types of attacks to the forefront."
Moody revealed that ransomware attacks have not subsided. "Sadly, however, while awareness around these types of attacks has grown, so too has the number of attacks. Since 2018, we've seen yearly increases in the number of ransomware attacks (except for a dip in 2022), and the amount of data involved in these attacks has also risen exponentially." Hackers have honed their focus on double-extortion tactics, whereby criminals not only encrypt systems for ransom but also steal sensitive data for additional leverage.
According to Comparitech's analysis, the UK has suffered 281 confirmed ransomware attacks since 2018, resulting in the breach of over 3.3 million records. Recent average ransom demands have reached nearly USD $8.6 million (GBP £6.5 million). For 2024 alone, there have been 40 attacks, affecting nearly 1.2 million records, with 12 attacks already reported so far this year. Moody noted that while no breaches have yet been reported for this year's attacks, significant numbers may emerge as incidents involving major companies such as Marks and Spencer and Co-op are investigated.
"As we've seen with Harrods, Co-op, and M&S, social engineering tactics were used to carry out these attacks, whereby employees were tricked into changing their passwords," Moody added. She underscored that despite the evolving threat landscape, the fundamentals for defending against ransomware remain unchanged: maintaining up-to-date systems, patching vulnerabilities promptly, regular backups, robust incident response planning, and comprehensive staff training.
This year, attention is also focusing on the rise of identity and cloud-driven attacks. Fabio Fratucello, Field CTO at CrowdStrike, explained: "Ransomware remains one of the most persistent and damaging threats facing organisations today. It has evolved far beyond being just an endpoint issue—it's now a challenge rooted in identity, cloud infrastructure and data security."
Fratucello cited data from CrowdStrike's 2025 Global Threat Report, noting, "79% of initial access attacks are now malware-free and access broker activity has surged by 50% year over year. This shows a clear pivot towards stealth and credential-based attacks, making traditional defences obsolete." He advocated for unified, AI-driven platforms that deliver protection and visibility across endpoints, identities, and the cloud, arguing that legacy, fragmented tools are no longer sufficient. "In today's threat landscape, visibility is protection. And protection must start with consolidation," Fratucello asserted.
Looking ahead, the interplay of artificial intelligence and cybercrime is poised to be the next frontier. KnowBe4, a prominent security company, predicts that agentic AI ransomware—autonomous, intelligent bots orchestrating attacks—will soon pose an unprecedented threat. Roger Grimes, KnowBe4's data-driven defense evangelist, commented: "AI agentic ransomware will gain initial access, analyse the environment, determine how to maximise malicious hacker profits, and implement the attacks. And it will not be just one attack, but a series of escalating attacks to maximise a malicious hacker's profit."
Ransomware payments escalated over the past year, with average amounts climbing to USD $2.73 million, according to KnowBe4. Grimes highlighted that malicious actors typically adopt innovations six to twelve months after they are developed by legitimate cybersecurity researchers. He urged organisations to leverage AI and advanced defences now to prepare for the threats on the horizon.
As cybercriminals continue to refine their tactics and exploit both technology and human factors, experts unanimously stress the enduring importance of proactive security practices. Regular training, technological consolidation, and continual vigilance remain the cornerstones of effective cyber defence against one of the digital age's most formidable adversaries.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Techday NZ
16 hours ago
- Techday NZ
Bebop reaches USD $1.2 million ARR in 45 days with SME focus
Bebop, an AI-driven sales enablement product developed by Black Pearl Group, has recorded USD $1.2 million in annual recurring revenue (ARR) within 45 days of its market launch. The announcement highlights Bebop as being the fastest-growing product in the company's portfolio, reaching its ARR milestone at twice the speed set by Pearl Diver, another product from the same company that attained USD $10 million in ARR over 24 months. Access for SMEs According to Black Pearl Group, many small and medium-sized enterprises (SMEs) have traditionally found themselves excluded from access to high-quality sales intelligence due to the cost and scale of established platforms such as ZoomInfo, Clearbit, and Apollo. Bebop is intended to address this gap. The company reports that Bebop provides rapid access to highly targeted lists of verified decision-makers at millions of US-based companies, supported by personalised strategic dossiers. Nick Lissette, Chief Executive Officer, commented on the product's rapid uptake: "Bebop is like ChatGPT, but specifically built for sales and revenue growth. This is one of the fastest go-to-market trajectories we've seen across the SaaS and AI landscape, and customers have rapidly validated our value proposition. We hit it out of the park with Pearl Diver, so it's extremely exciting to see Bebop overtake its impressive early adoption. Bebop's traction validates our core thesis: that speed, usability, and value drive adoption. And our platform was built to scale these advantages, fast" Positioned on cost The company states that Bebop delivers sales intelligence tools similar in function to existing enterprise solutions but is priced to make such tools accessible to SMEs. This approach, Black Pearl Group claims, meets growing demand for AI-based and cost-effective sales applications tailored to SME needs. Lissette further said, "There's rising demand for AI-native, cost-effective sales tools that solve real SME challenges. With Bebop, we imagined unlocking unlimited revenue opportunities and cutting-edge business intelligence. Early customer feedback highlights Bebop's ability to 'save hours in research,' 'generate customers effortlessly,' and 'bring the power of AI to the everyday business owner'. That's real results; and a real threat to Silicon Valley sales giants." He contrasted Bebop's capability with earlier generations of business-to-business sales software, which he described as depending largely on SQL queries with interfaces optimised to simplify data retrieval. According to Lissette, Bebop's design provides a distinct experience by understanding both the offerings of a business and its relevant target market, ultimately helping to generate actionable insights for revenue generation. Lissette stated, "Bebop has intelligence at its core – genuinely understanding what a business provides and exactly who needs it. Our product delivers a fundamentally different experience that unlocks deep insights that fuel measurable revenue growth." Product development and outlook Bebop was built and brought to market within 90 days, which the company credits to its ongoing investment in its proprietary Pearl Engine software and underlying data infrastructure. The company suggests this effort illustrates its ongoing technology-driven approach to product development. Lissette added, "That conviction has been validated. The results show Bebop is not just viable – it's a force multiplier for BPG's revenue growth. It now stands alongside Pearl Diver as a key driver in our product portfolio, reinforcing our strategy of building scalable, high-impact tools for customer acquisition." He continued, "Bebop's rapid market-fit means our line of sight on USD $20 million ARR is even clearer. And this also will greatly contribute to our medium target of USD $50 million ARR." Karen Cargill, Interim Chief Financial Officer, remarked, "We have deliberately invested since our capital raise into platform development and talent acquisition. The vision and engine is working. Our investment and market timing have aligned. With two products both demonstrating scale and demand, we're well positioned for sustained growth."
Techday NZ
16 hours ago
- Techday NZ
Exclusive: AI drives new cyber threats & resilience strategies in APJ
There is both opportunity and risk, as artificial intelligence (AI) is adopted at enterprises across the region, according to Ben Young, Field CTO for APJ at Veeam. He also sees businesses are under pressure not only to adopt new technologies but also to shore up their defences as adversarial groups increasingly harness the same innovations for malicious purposes. "Every single vertical can benefit from some form of AI adoption," Young asserts. "But it's a double-edged sword. Just as we're trying to innovate, the threat groups-cyber adversaries-are leveraging AI as well." He points to the growing accessibility of AI-powered toolkits that lower the bar for launching attacks: "There are tools you can buy for a few hundred USD a month as a subscription, and they allow non-experts to write malware or deploy very convincing phishing campaigns. Large language models can push spear phishing click-through rates from industry averages of 12% up to 54%." This sharp escalation in the sophistication and volume of threats comes at a pivotal time when organisations are also accelerating their AI strategies. Veeam, which originally established its brand in backup and disaster recovery, is rapidly expanding its portfolio to address an evolving landscape, protecting hybrid environments, SaaS platforms, and even providing storage for backup workloads. Young notes that the company's partnerships, especially with Microsoft on Azure, have enabled it to offer backup-as-a-service while leveraging global economies of scale-critically, with "no egress and no API transaction fees." However, he's quick to add that adaptability is part of its core: "It's on the roadmap for other clouds to run these things, because not everyone's an Azure shop." The broadening definition of business resilience now brings backup and security disciplines much closer together. 90% of cyber attacks focus on backup repositories, which has resulted in disaster recovery and cybersecurity being intertwined. "Backups are the last resort, and threat actors know it. If they take out your backups, your only options are to pay the ransom and hope for the best," Young explains. Veeam's acquisition of CoveWare, an incident response firm, enables the direct integration of real-world telemetry and threat intelligence into Veeam's product development and customer education initiatives. Changing regulations are also playing a critical part. The recently enacted Japanese cyber defence bill mandates the reporting of ransomware incidents and the development of regular response plans. Young applauds this direction, noting, "It's critical we talk about incidents-otherwise these are not board-level discussions and security teams struggle for budget." He points out that cyber extortion is no longer a niche risk. Financial institutions and public sector organisations, in particular, are contending with increasingly sophisticated AI-enabled attacks while balancing compliance, governance, and privacy regulations across diverse national boundaries. The surge in 'shadow IT'-where departments launch unsanctioned SaaS, AI applications or cloud projects-presents new blind spots. "We're seeing lots of little shadow IT projects, especially as people rush to experiment with AI. When that gets to production, who is looking after that system? It's the same shadow IT problem we've seen for years, now amplified by the ease of consuming AI services," Young says. This requires a step change in visibility. Veeam is responding by mapping and analysing customers' data footprints and building automated support, monitoring, and reporting features through its observability platform. The company's AI-powered 'Veeam Intelligence Engine' is designed to suggest remediations, generate code samples, and flag risks in natural language-"making support and reporting far more accessible," says Young. The complexity of emerging architectures compounds the challenge of AI adoption. "We're really good at protecting databases and webservers because we know what they are and how to back them up. But with the introduction of vector databases, AI agents, and model training checkpoints, we need new strategies," Young explains. The potential cost and risk of a failed AI project, such as losing weeks of model training due to corrupted data, is prompting enterprises to consider backup and recovery for infrastructure previously outside the IT remit. "Agents are going to be central to the future, especially with more reliable, reflective AI systems. The good news is, most of these platforms run on environments-Kubernetes, cloud infrastructure-that we already protect." Young identifies security lapses as a persistent oversight in the current rush to implement AI: "It's the shiny new thing, and the basics can be forgotten. If we can get people thinking about security as part of their DNA while deploying AI, they'll be better off." He cautions that most SaaS providers operate a shared responsibility model: "Microsoft or Salesforce take care of the platform, not your data. If it's deleted from the cloud, it's gone-vendors won't provide a full backup. Your data is your responsibility." Against this backdrop, keeping pace with threats requires organisation-wide preparation. Veeam's customer workshops and regular incident simulations demonstrate a commitment to education as a proactive defence. "Preparation is the key: practice and plan. Use your tools, test your backups, scan for vulnerabilities, and have a response plan. Yara signature rules, for example, can be imported to scan for specific attack strains in backup archives," Young says, emphasising the importance of practical readiness over theoretical robustness. Young notes that Veeam's AI and resilience roadmap is anchored in five pillars: infrastructure resilience, intelligence, security pre- and post-attack, and business value extraction from archived data. The company's long-standing data integration API, for instance, enables the surfacing of unstructured data, ranging from images to documents, for AI applications, analytics, or compliance. "AI applications require fuel, and that fuel is data. Unlocking value from our organisations means thinking beyond expensive, monolithic data lakes, and instead focusing on the ability to extract insight from all data sources, structured or not." "Our role is to assist with growing compliance, governance, and regulatory requirements, but also to bring responsible, opt-in AI features to our customers and to help make data protection, cybersecurity, and digital transformation board-level priorities," Young concludes. "It's critical we talk about incidents-it raises awareness across all organisations. If we don't, it's not going to be a board-level discussion, and teams will struggle to get budget for this stuff."
Techday NZ
a day ago
- Techday NZ
AI drives 80 percent of phishing with USD $112 million lost in India
Artificial intelligence has become the predominant tool in cybercrime, according to recent research and data from law enforcement and the cybersecurity sector. AI's growing influence A June 2025 report revealed that AI is now utilised in 80 percent of all phishing campaigns analysed this year. This marks a shift from traditional, manually created scams to attacks fuelled by machine-generated deception. Concurrently, Indian police recorded that criminals stole the equivalent of USD $112 million in a single state between January and May 2025, attributing the sharp rise in financial losses to AI-assisted fraudulent operations. These findings are reflected in the daily experiences of security professionals, who observe an increasing use of automation in social engineering, malware development, and reconnaissance. The pace at which cyber attackers are operating is a significant challenge for current defensive strategies. Methods of attack Large language models are now being deployed to analyse public-facing employee data and construct highly personalised phishing messages. These emails replicate a victim's communication style, job role and business context. Additionally, deepfake technology has enabled attackers to create convincing audio and video content. Notably, an incident in Hong Kong this year saw a finance officer send HK $200 million after participating in a deepfake video call bearing the likeness of their chief executive. Generative AI is also powering the development of malware capable of altering its own code and behaviour within hours. This constant mutation enables it to bypass traditional defences like endpoint detection and sandboxing solutions. Another tactic, platform impersonation, was highlighted by Check Point, which identified fake online ads for a popular AI image generator. These ads redirected users to malicious software disguised as legitimate installers, merging advanced loader techniques with sophisticated social engineering. The overall result is a landscape where AI lowers the barriers to entry for cyber criminals while amplifying the reach and accuracy of their attacks. Regulatory landscape Regulators are under pressure to keep pace with the changing threat environment. The European Union's AI Act, described as the first horizontal regulation of its kind, became effective last year. However, significant obligations affecting general-purpose AI systems will begin from August 2025. Industry groups in Brussels have requested a delay on compliance deadlines due to uncertainty over some of the rules, but firms developing or deploying AI will soon be subject to financial penalties for not adhering to the regulations. Guidance issued under the Act directly links the risks posed by advanced AI models to cybersecurity, including the creation of adaptive malware and the automation of phishing. This has created an expectation that security and responsible AI management are now interrelated priorities for organisations. Company boards are expected to treat the risks associated with generative models with the same seriousness as data protection or financial governance risks. Defensive measures A number of strategies have been recommended in response to the evolving threat environment. Top of the list is the deployment of behaviour-based detection systems that use machine learning in conjunction with threat intelligence, as traditional signature-based tools struggle against ever-changing AI-generated malware. Regular vulnerability assessments and penetration testing, ideally by CREST-accredited experts, are also regarded as essential to expose weaknesses overlooked by both automated and manual processes. Verification protocols for audio and video content are another priority. Using additional communication channels or biometric checks can help prevent fraudulent transactions initiated by synthetic media. Adopting zero-trust architectures, which strictly limit user privileges and segment networks, is advised to contain potential breaches. Teams managing AI-related projects should map inputs and outputs, track possible abuse cases, and retain detailed logs in order to meet audit obligations under the forthcoming EU regulations. Staff training programmes are also shifting focus. Employees are being taught to recognise subtle cues and nuanced context, rather than relying on spotting poor grammar or spelling mistakes as indicators of phishing attempts. Training simulations must evolve alongside the sophistication of modern cyber attacks. The human factor Despite advancements in technology, experts reiterate that people remain a core part of the defence against AI-driven cybercrime. Attackers are leveraging speed and scale, but defenders can rely on creativity, expertise, and interdisciplinary collaboration. "Technology alone will not solve AI‑enabled cybercrime. Attackers rely on speed and scale, but defenders can leverage creativity, domain expertise and cross‑disciplinary thinking. Pair seasoned red‑teamers with automated fuzzers; combine SOC analysts' intuition with real‑time ML insights; empower finance and HR staff to challenge 'urgent' requests no matter how realistic the voice on the call," said Himali Dhande, Cybersecurity Operations Lead at Borderless CS. The path ahead There is a consensus among experts that the landscape has been permanently altered by the widespread adoption of AI. It is increasingly seen as necessary for organisations to shift from responding to known threats to anticipating future methods of attack. Proactive security, embedded into every project and process, is viewed as essential not only for compliance but also for continued protection. Borderless CS stated it, "continues to track AI‐driven attack vectors and integrate them into our penetration‐testing methodology, ensuring our clients stay ahead of a rapidly accelerating adversary. Let's shift from reacting to yesterday's exploits to pre‐empting tomorrow's."
