Cyber criminals have adopted a "gold rush" mentality after successfully using ransomware to extort money from businesses, United States security software firm Symantec has warned.
It might only be a matter of time before they took a leaf out of the "Stuxnet" book and held industrial computer systems used to run the likes of manufacturing systems to ransom, the company said in a report published on Wednesday.
![Consumers are still being hit by ransomware, but criminals are increasingly after richer pickings.](/web/20160823213352im_/http://www.theage.com.au/content/dam/images/g/q/9/f/u/i/image.related.articleLeadwide.620x349.gq9fsd.png/1468971707741.jpg)
Stuxnet was malware that was believed to have been developed by US and Israeli security services to disrupt Siemens software that controlled uranium centrifuges at the heart of Iran's nuclear programme.
Symantec Asia Pacific cyber security manager Nick Savvides speculated manufacturers or oil refineries might pay ransoms of tens of thousands of dollars to "make a problem go away".
But he saw less likelihood of successful ransomware attacks against key utilities such as electricity networks, because the likes of professional services firms and healthcare organisations were easier targets.
Ransomware victims in the region have included the MidCentral District Health Board in New Zealand, which was attacked in February.
It didn't pay a ransom and managed to restore its files from backups, which is the surest defence against ransomware.
Most ransomware was distributed "randomly" online, for example through spam emails, affecting both consumers and businesses, Symantec said.
But criminals were increasingly targeting businesses and other organisations, for example by exploiting security vulnerabilities in public-facing web servers, its report said.
"The time and skill required to mount such attacks is far in excess of that required for standard ransomware campaigns, but the rewards are potentially much greater."
Reflecting that, the average "fee" ransomware blackmailers tried to extort from victims in return for unlocking their computer files had more than doubled in the course of a year from $US294 to $US679, it said.
Crypto-ransomware, the most "popular" form of ransomware attack, works by infecting a victim's computer or phone and then encrypting the data on the devices using a digital key that criminals will only hand over if victims pay up.
The success of crypto-ransomware had prompted a surge in attacks against victims in affluent countries, Symantec said.
However, data in its report suggested there had been a significant dip in attacks in April — the last month for which it reported numbers — with worldwide infections falling to fewer than 80,000, from more than 120,000 in March.
Symantec said there was also a big lull in certain types of attack in June, which coincided with the arrests of a number of suspected cyber criminals in Russia, though it said that activity now seemed to be resuming.
Receiving ransom payments was a challenge for criminals, as even transactions in favoured "crypto-currencies" such as Bitcoin were "not wholly anonymous", it said.
Stuff.co.nz