Illustration: Aïda Amer/Axios

Ransomware attacks are becoming smarter, more common, and more dangerous.

What's happening: In ransomware incidents, attackers take systems down and demand payment (usually in bitcoin) to restore access to them.

  • Compared with the political impact of election hacking or the privacy violations of data breaches, ransomware has typically been viewed as the cyber equivalent of hit-and-run robbery.
  • But aggressive new tactics, including threats of massive file dumps, are blurring the lines between ransomware and other attacks, making them a national security issue as well as a business problem.

Driving the news: In the latest indication that ransomware is moving beyond its best-known targets — state and local governments and healthcare systems — a Department of Homeland Security advisory on Tuesday reported a ransomware attack that forced a natural gas compression facility to shut down two days.

  • Analysts at Dragos identified the incident as one reported in December by the Coast Guard.
  • Last month, researchers at Emsisoft warned that ransomware attacks could disrupt the 2020 U.S. elections. "[T]hreat actors could use ransomware to tamper with the 2020 election process by attacking county-level entities and lower-level election officials," according to the Emsisoft report. Attacks could "potentially disrupt local voting infrastructure, stifle access to information, leak voter data and ultimately undermine public trust."
  • The Palm Beach County, Florida, election supervisor told the Palm Beach Post last week that the county had suffered a ransomware attack in September 2016. The county's previous election supervisor, who was in office then, denied the report.

The big picture: A raft of recent ransomware research paints an alarming picture of a threat that's still evolving.

  • The threat analysis firm Recorded Future reports a 20% increase in ransomware incidents affecting state and local governments and healthcare institutions year-to-date for 2020 compared with the same period in 2019.
  • Recorded Future and other analysts note that many ransomware attackers now also seize mountains of data from target networks before shutting them down, then use the threat of publicizing the private documents to demand payment.
  • In another trend, a whole industry of "ransomware as a service" providers is emerging to handle the technical work for would-be ransom takers.
  • IBM reports "high levels of code innovation" in the ransomware realm, and finds that the most common vulnerability exploited by ransomware is a flaw in a part of the Windows operating system called SMB, or "server message block."

Yes, but: The full scope of ransomware activity is tough to gauge because private industry is under no obligation to report incidents — and many affected companies are unlikely to admit they've been had.

  • According to the FBI's Internet Crime report for 2019, the IC3 received 2,047 complaints identified as ransomware last year, with adjusted losses of over $8.9 million.
  • That's compared to a total of 467,361 complaints of all kinds in 2019 — an average of nearly 1,300 every day — with more than $3.5 billion in losses to individual and business victims.

Go deeper

1 hour ago - Podcasts

Facebook boycott organizers share details on their Zuckerberg meeting

Facebook is in the midst of the largest ad boycott in its history, with nearly 1,000 brands having stopped paid advertising in July because they feel Facebook hasn't done enough to remove hate speech from its namesake app and Instagram.

Axios Re:Cap spoke with the boycott's four main organizers, who met on Tuesday with CEO Mark Zuckerberg and other top Facebook executives, to learn why they organized the boycott, what they took from the meeting, and what comes next.

Boycott organizers slam Facebook following tense virtual meeting

Illustration: Sarah Grillo/Axios

Civil rights leaders blasted Facebook's top executives shortly after speaking with them on Tuesday, saying that the tech giant's leaders "failed to meet the moment" and were "more interested in having a dialogue than producing outcomes."

Why it matters: The likely fallout from the meeting is that the growing boycott of Facebook's advertising platform, which has reached nearly 1000 companies in less than a month, will extend longer than previously anticipated, deepening Facebook's public relations nightmare.

Steve Scalise PAC invites donors to fundraiser at Disney World

Photo: Kevin Lamarque-Pool/Getty Images

House Minority Whip Steve Scalise’s PAC is inviting lobbyists to attend a four-day “Summer Meeting” at Disney World's Polynesian Village in Florida, all but daring donors to swallow their concern about coronavirus and contribute $10,000 to his leadership PAC.

Why it matters: Scalise appears to be the first House lawmakers to host an in-person destination fundraiser since the severity of pandemic became clear. The invite for the “Summer Meeting” for the Scalise Leadership Fund, obtained by Axios, makes no mention of COVID-19.