Australian Authorities Uncovered Activities and Careers of Ransomware Criminal Groups

Ransomware has emerged as one of the most devastating cybercrime threats in the contemporary digital landscape, with criminal organizations operating sophisticated billion-dollar enterprises that target critical infrastructure across multiple nations.

Between 2020 and 2022, ransomware groups conducted over 865 documented attacks against organizations in Australia, Canada, New Zealand, and the United Kingdom, employing advanced cryptoviral techniques that encrypt victims’ data systems while demanding cryptocurrency payments for decryption keys.

The evolution of these criminal enterprises has transformed from simple encryption-based extortion to complex “double extortion” and “triple extortion” schemes, where attackers not only encrypt data but also threaten to sell or publicly expose stolen information.

These groups compromise systems through various attack vectors including botnets, malicious freeware, and sophisticated phishing campaigns that exploit human cognitive biases to gain initial access to target networks.

The emergence of Ransomware-as-a-Service (RaaS) models has fundamentally altered the cybercrime ecosystem, creating a distinction between core ransomware developers and affiliate operators.

Core groups focus on malware development, distribution infrastructure, victim payment processing, and maintaining leak sites, while affiliates handle the tactical elements of system compromise, ransomware deployment, and ransom negotiations.

AIC analysts identified that this market-based relationship structure allows cybercriminals to move fluidly between different ransomware organizations, adapting quickly to law enforcement pressures and market opportunities.

Research conducted by the Australian Institute of Criminology reveals that Conti emerged as the most prolific ransomware organization, orchestrating 141 attacks across the three-year period, followed closely by the combined LockBit variants responsible for 129 attacks.

The data demonstrates that groups adopting RaaS models and maintaining operational continuity across multiple years achieved significantly higher attack volumes than traditional ransomware operations.

Technical Infrastructure and Operational Mechanisms

The technical sophistication of modern ransomware operations extends far beyond simple file encryption, incorporating advanced persistence mechanisms and detection evasion techniques.

Ransomware groups typically establish initial access through credential stuffing attacks, exploitation of unpatched vulnerabilities, or social engineering campaigns targeting remote desktop protocols.

Once inside target networks, attackers deploy lateral movement techniques using legitimate administrative tools like PowerShell and Windows Management Instrumentation to avoid detection.

The persistence phase involves establishing multiple backdoors throughout compromised networks, often utilizing legitimate system processes to maintain stealth.

Groups like Conti and LockBit implement sophisticated reconnaissance protocols, systematically mapping network architecture, identifying critical data repositories, and locating backup systems before deploying encryption payloads.

The encryption process itself employs military-grade cryptographic algorithms, with many groups utilizing hybrid encryption schemes combining symmetric and asymmetric encryption to optimize both speed and security.

Most active ransomware groups analysis:-

Sector targeting distribution:-

The industrial sector emerged as the primary target across all analyzed countries, accounting for 239 total attacks.

This targeting preference reflects both the critical nature of industrial operations and the sector’s vulnerability to operational disruption, making organizations more likely to pay ransoms to restore production capabilities quickly.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.