Top cybersecurity threats for September 2023

Top takeaways:

• LockBit has asked affiliates to decide on a new ransom payment policy
• One affiliate has already taken a hard line, threatening data destruction if its demands aren't met
• Changes to policy could escalate the cost of ransomware breaches significantly

Prolific ransomware group LockBit was by far the most successful outfit in August, listing 126 victims on its leak site, according to Verizon intelligence. However, the group is being forced to address internal policy issues, after observing a major inconsistency in the amount of ransom demanded by different affiliates. It issued a poll to these affiliates earlier this month, which could have a significant impact on victims.

The options offered to affiliates were:

1. Maintain the status quo and allow individual threat groups to decide on the ransom amount
2. Set a minimum payment of 3% of victims' annual revenue with the option of a 50% discount
3. A new rule where affiliates can only grant a 50% discount on the original ransom price
4. No payment accepted below the victim's maximum ransomware insurance policy
5. A minimum payment of 50% of the victim's ransomware insurance policy to be accepted

Already, one affiliate dubbed the National Hazard Agency has said it will not accept less than 3% of victims' annual revenue and has vowed to destroy data if negotiators try to bargain them down.

The debate highlights the struggle ransomware groups are having in monetizing their attacks but could also signal a new hard line on payments, which may harm victims financially.