The SamSam ransomware may have made its creators quite rich.
New research from the security firm Sophos estimates the notorious ransomware strain has raked in $5.9 million by infecting computers and holding the data inside hostage.
Sophos came to the $5.9 million figure by teaming up with a cryptocurrency monitoring provider called Neutrino to identify which Bitcoin addresses the hackers had been using to receive the ransom payments. In total, they identified 157 unique addresses, and estimate that 233 victims gave in to the ransom demands since the malicious coding arrived on the scene back in late 2015.
For the uninitiated, ransomware attacks work by encrypting all the data inside a computer and then threatening to delete it unless the victim pays up, usually in Bitcoin. SamSam most recently grabbed headlines for crippling the IT systems of Atlanta's city government. In that attack, the hackers demanded a payment of $51,000 to unlock all the computers infected with the ransomware. Earlier this month, the SamSam strain also attacked LabCorp, a major provider of clinical lab testing.
Why does SamSam keep infecting computers? According to Sophos, the hackers have been targeting Windows computer that can be accessed online over Microsoft's Remote Desktop Protocol (RDP). Unfortunately, simply entering the right password is sometimes all you need to break into these computers.
"SamSam usually succeeds when the victim chooses a weak, easily guessed password," Sophos said in its report. Computers with RDP-enabled can also be exposed on the open internet, making them easy to find over a search engine such as Shodan.
Once access is gained, the hackers can proceed to scan the victim's networks for other computers and decide how to go about spreading the SamSam ransomware.
Sophos has collected the ransom notes used in previous attacks and found that over time SamSam's creators have been demanding higher and higher sums from their victims. Starting in early 2016, the crooks were only demanding from between $9,600 to $18,700. However, lately, the hackers have been wanting closer to $40,000.
According to Sophos, the SamSam ransomware will try to infect a new victim about once a day; the attack itself will usually occur late at night when employees are off work and sleeping. Although the creators of SamSam are still unknown at this point, they've largely been targeting victims in the US, including governments, health care providers, in addition to private businesses.
"The cost victims are charged in ransom has increased dramatically, and the tempo of attacks shows no sign of slowdown," Sophos warned.
The security firm's report and a separate blog post feature tips on how organizations can protect themselves from the SamSam ransomware strain. They include placing better protection around computers capable of remote access online, such as multi-factor authentication and requiring a VPN connection to use them.