‘Cops and Robbers’: Prime 5 ransomware teams behind practically half of all assaults

This text was produced in partnership with Cowbell.

As cyber threats enhance in frequency and complexity, companies face growing strain to strengthen their defenses. In accordance with Cowbell’s Cyber ​​Roundup: Claims Report 2025, organizations are witnessing a continued enhance in each the quantity and class of cyber-attacks globally, pushed primarily by AI-enhanced campaigns.

Moreover, industry-wide knowledge from the 2024 NAIC Cyber ​​Insurance coverage Report exhibits a report variety of not too long ago reported cyber insurance coverage claims at 33,561, indicating a gentle enhance in declare frequency. However, Cowbell’s inside claims knowledge paints a murky image. Whereas the frequency of widespread incidents has elevated, ransomware claims have remained steady, persistently accounting for 17-19% of all Cowbell claims from 2022 to 2024.

speak to Insurance coverage enterpriseTrent Cooksley, co-founder and chief working officer of Cowbell, made it clear that within the face of this rising concern, it is very important act preventative fairly than healing.

“The frequency is growing throughout the board,” Cooksley agreed. “[As such]employers ought to contemplate the downtime they might expertise if a seizure happens. Lengthy-term occasions, which means enterprise interruption, are a part of one thing bigger occurring within the market, as are lawsuits and sophistication motion lawsuits, particularly in america.

“All organizations, no matter dimension, can deploy low- or no-budget protections that may dramatically scale back danger. Multi-factor authentication (MFA) – we discuss it on a regular basis, however it’s stunning how many individuals aren’t already making the most of it, or worse, in the event that they’re utilizing it, they are not configuring it appropriately.” [It’s all about] Worker Coaching – Once more, as a result of phishing is changing into more and more complicated to interpret. ”

And the info backs Cooksley up. In accordance with Cowbell’s report, phishing stays the most typical assault initiation methodology and sometimes serves as an entry level for extra critical incidents akin to enterprise e-mail compromise (BEC), funds switch fraud, and ransomware. Moreover, the FBI reported 193,000 complaints associated to phishing and spoofing in 2024, making these techniques essentially the most reported cybercrime in america.

As Mr. Cooksley mentioned, IBPreparation is important right here. A corporation’s true measure of success is planning earlier than an incident happens. So we do not simply “fireplace within the air” and act after the very fact.

“Have a response plan in place. Folks ought to know tips on how to take care of these points,” Cooksley mentioned. “Our workforce at Cowbell can help policyholders with all of this.”

And there is not any scarcity of organized cybercrime teams attempting to pry your knowledge. In accordance with the Cowbell report, 5 ransomware teams are behind roughly 48% of recognized risk actors incidents.

“A number of small companies haven’t purchased it but,” he mentioned. IB. “[But] This is a crucial monetary and operational security internet within the occasion of an incident. However for us, one of the best carriers do not simply wish to reply to violations and pay the payments, they wish to proactively assist their policyholders construct resilience.

“At Cowbell, we try this via free and discounted providers akin to: [cybersecurity awareness] These embrace coaching, darkish net monitoring, phishing simulations, penetration testing, and establishing an incident response hotline. It is as a lot an funding in cyber insurance coverage as it’s to pay out when one thing occurs. ”

Fundamental safety is essential, however as firms develop or face elevated dangers, Cooksley revealed that extra superior protections change into important.

“The following step is extra superior cybersecurity measures,” he mentioned. “So for organizations of a sure dimension, that is when you have to begin considering critically about the way you’re rising, going through elevated danger, and increasing past the fundamentals. This contains managed detection and response, endpoint safety, and penetration testing so you possibly can see the place your weaknesses are. Third-party assessments, vendor and provide chain danger assessments – are you in touch with particular distributors? If they’ve one thing, how does that influence your small business?”

The Cowbell report definitely agrees with this, with researchers stressing that preventing cybercrime requires organization-wide change. Right here, the report presents a four-step strategy.

1. Improve your incident response capabilities with expert negotiation and speedy motion.
2. Prioritize cyber hygiene and patch administration to defend towards more and more focused assaults.
3. Strengthen partnerships between companies and cyber insurers to make sure help via each the prevention and restoration phases.
4. Put money into proactive instruments and danger monitoring, akin to Cowbell Elements, to scale back danger and enhance claims outcomes.

In the case of organizations investing in cyber insurance coverage, smaller companies are likely to have a misplaced sense of safety. As a result of the media tends to solely report headlines about world cyberattacks, ransomware robberies that value companies hundreds of thousands of {dollars}, small companies suppose it is going to by no means occur to them, however how incorrect that’s.

“They in all probability have extra gaps than they notice,” Cooksley added. “And whereas many risk actors prefer to go after the massive fish, they do not all the time particularly goal it. They take a shotgun strategy. Consider it as robbing anybody strolling down the road and whose door is unlocked.”

This false confidence is what makes small and medium-sized companies ripe for removing. In accordance with knowledge compiled by Astra, small companies account for 43% of cyberattacks annually, costing them a median of $25,000. Furthermore, solely 14% of affected small companies had been truly ready to face such an assault, and cash solely accounts for a portion of the losses.

“Should you’re smaller, you won’t have the resilience to maintain going,” Cooksley added. “Should you get contaminated with ransomware, are you able to proceed your small business? I’d argue that there are lots of people who cannot. Dropping a shopper for a small enterprise has a a lot larger influence than dropping a shopper for a very massive group. Companies can face up to it a bit bit extra. And it additionally prices them more money to really get well as a result of they do not have the inner capability to get well.” [Here]Insurance coverage may help fill the hole by offering safety in addition to essential assets to rapidly get well after an assault. ”