Illustration: Aïda Amer/Axios

Ransomware attacks are becoming smarter, more common, and more dangerous.

What's happening: In ransomware incidents, attackers take systems down and demand payment (usually in bitcoin) to restore access to them.

  • Compared with the political impact of election hacking or the privacy violations of data breaches, ransomware has typically been viewed as the cyber equivalent of hit-and-run robbery.
  • But aggressive new tactics, including threats of massive file dumps, are blurring the lines between ransomware and other attacks, making them a national security issue as well as a business problem.

Driving the news: In the latest indication that ransomware is moving beyond its best-known targets — state and local governments and healthcare systems — a Department of Homeland Security advisory on Tuesday reported a ransomware attack that forced a natural gas compression facility to shut down two days.

  • Analysts at Dragos identified the incident as one reported in December by the Coast Guard.
  • Last month, researchers at Emsisoft warned that ransomware attacks could disrupt the 2020 U.S. elections. "[T]hreat actors could use ransomware to tamper with the 2020 election process by attacking county-level entities and lower-level election officials," according to the Emsisoft report. Attacks could "potentially disrupt local voting infrastructure, stifle access to information, leak voter data and ultimately undermine public trust."
  • The Palm Beach County, Florida, election supervisor told the Palm Beach Post last week that the county had suffered a ransomware attack in September 2016. The county's previous election supervisor, who was in office then, denied the report.

The big picture: A raft of recent ransomware research paints an alarming picture of a threat that's still evolving.

  • The threat analysis firm Recorded Future reports a 20% increase in ransomware incidents affecting state and local governments and healthcare institutions year-to-date for 2020 compared with the same period in 2019.
  • Recorded Future and other analysts note that many ransomware attackers now also seize mountains of data from target networks before shutting them down, then use the threat of publicizing the private documents to demand payment.
  • In another trend, a whole industry of "ransomware as a service" providers is emerging to handle the technical work for would-be ransom takers.
  • IBM reports "high levels of code innovation" in the ransomware realm, and finds that the most common vulnerability exploited by ransomware is a flaw in a part of the Windows operating system called SMB, or "server message block."

Yes, but: The full scope of ransomware activity is tough to gauge because private industry is under no obligation to report incidents — and many affected companies are unlikely to admit they've been had.

  • According to the FBI's Internet Crime report for 2019, the IC3 received 2,047 complaints identified as ransomware last year, with adjusted losses of over $8.9 million.
  • That's compared to a total of 467,361 complaints of all kinds in 2019 — an average of nearly 1,300 every day — with more than $3.5 billion in losses to individual and business victims.

Go deeper

Trump's 2 chilling debate warnings

Photo: Morry Gash/Pool via Getty Images

One of the few groups in America with anything to celebrate after last night's loud, ugly, rowdy presidential "debate" was the violent, far-right Proud Boys, after President Trump pointedly refused to condemn white supremacist groups.

Why it matters: This was a for-the-history-books moment in a debate that was mostly headache-inducing noise. Trump failed to condemn racist groups after four months when millions marched for racial justice in the country's largest wave of activism in half a century.

Ina Fried, author of Login
56 mins ago - Technology

Candidates go online to cut through debate noise

Photo: Saul Loeb/AFP via Getty Images

While President Trump and Joe Biden fought to be heard in a rowdy debate Tuesday, both campaigns sought to draw digital battle lines and occupy online turf they could have all to themselves.

The big picture: Trump's impulsive Twitter style made a shambles of the debate format, but online the candidates were able to find niches where they couldn't be interrupted — and could motivate their supporters to donate, organize and turn out to vote.

Ben Geman, author of Generate
2 hours ago - Energy & Environment

Shell plans up to 9,000 job cuts by 2022

A Shell station in Brazil. Photo: Rafael Henrique/SOPA Images/LightRocket via Getty Images

Royal Dutch Shell will shed up to 9,000 jobs as it undergoes a long-term restructuring around climate-friendly energy sources and continues to grapple with the coronavirus pandemic that has battered the oil industry.

Why it matters: The cuts could amount to over 10% of the company's global workforce, which was 83,000 at the end of 2019.