overseas banks , power stations , and even Cadbury factories in Australia last week have issued a new ransom demandAttack.Ransom— and it ’ s for much more money than before . The new ransom note was published in two places on the Dark Web and demanded a paymentAttack.Ransomof 100 Bitcoins , or about $ 340,000 , in return for a private security key that could decrypt any file locked by the Petya/Goldeneye malware . The hackers even opened a chat room and offered to decrypt one file for potential buyers as proof that the key would work , though it ’ s not clear whether this was a bluff . The demandAttack.Ransomwas a significant increase on the ransomware ’ s initial requestAttack.Ransomfor just less than $ 400 in Bitcoin when the malware was launched in the Ukraine last Tuesday before rapidly spreading through computer networks worldwide . Bitcoin transactions show its creators were able to access more than $ 13,000 paidAttack.Ransomby victims , however , even though their email address was suspended by its German provider . It ’ s not known whether victims who paid the ransomAttack.Ransomreceived a security key to unlock their files . The dangerous ransomware affected as many as 16,000 computers in 64 countries , according to security firm Clavister , and crippled the operations of several European companies . Some Australian businesses were also affected through their international connections , including Cadbury factories in Tasmania and Victoria , TNT Express courier services , and the offices of law firm DLA Piper . The demandAttack.Ransomor money came amid growing speculation that the ransomware was not designed to make a profit , but was a form of digital terrorism or industrial espionage . ESET senior research fellow Nick FitzGerald said the Petya malware was designed to kill computers first , and ask for moneyAttack.Ransomsecond . “ ( Being ransomware ) was a mechanism to help hide the trail of a gang of cyber terrorists or spies , ” he said . Mr FitzGerald advised victims not to pay any ransomAttack.Ransomas there was very little chance they would be able to unlock their files .
Ransomware has largely been an opportunistic , rather than a targeted , form of cybercrime with the goal of infecting as many users as possible . That model has worked so effectively that extortion is now ubiquitous when it comes to cybercrime — so much so that even fake attacks are proving to be successful . As I wrote earlier this month , the surge of extortion attacksAttack.Ransomimpacting organizations has led to a number of fake extortion threats , including empty ransomware demandsAttack.Ransomwhere actors contact organizations , lie about the organization ’ s data being encrypted , and ask for moneyAttack.Ransomto remove the non-existent threat . Cybercriminals like to follow the path of least resistance , and an attack doesn ’ t get much easier than simply pretending to have done something malicious . However , attacksAttack.Ransomover the past year have proven that infecting organizations with ransomware can result in much higher payoutsAttack.Ransom. The more disruptive the attack , the more money some organizations are willing to pay to make the problem go away . As a result , ransomware actors are shifting their targets towards more disruptive attacks , which we examine in our latest report , Ransomware Actors Shift Gears : New Wave of Ransomware AttacksAttack.RansomAims to Lock Business Services , Not Just Data . It was just 13 months ago that Hollywood Presbyterian Medical Center made national attention by payingAttack.Ransom$ 17,000 to decrypt its files after a ransomware attackAttack.Ransom. The incident was novel at the time , but those types of stories have since become commonplace . Organizations need to take action to protect themselves against ransomware actors that are trying to find more effective ways to disrupt business operations and demand even higher ransom payoutsAttack.Ransom.