In May 2021, the DarkSide ransomware gang – often rumoured to be linked to REvil – took down fuel supplier Colonial Pipeline. As petrol stations ran dry and American motorists panicked, the company had little option but to hand over $4.4m (£3.3m).

In the case of Travelex, even coughing up didn’t help. The biggest factor in the collapse of Travelex in August 2020 may have been the effects of Covid-19 on tourism but lingering damage from a ransomware attack earlier that year helped tip it over the edge. Travelex reportedly paid a $2.3m ransom but the loss of trust from customers was lasting.

Ransomware attacks are on the rise. There were 1,396 in 2020, according to Ransom-DB, which tracks such incidents. The number nearly doubled to 2,699 in 2021, with about 35-40% of cases ending in a ransom payment.

The likelihood, Ransom-DB says, is that many more go unreported. In the UK, the body responsible for stemming the tide is the National Cyber Security Centre (NCSC).

Its deputy director of incident management, Eleanor Fairford, says: “As long as cybercriminals make gains, as long as people pay them, it’s a business model that is very lucrative. There’s no reason why it should stop.”

Some have proposed banning companies from paying ransoms, in theory removing the incentive for such attacks. This, warns Fairford, may just result in companies failing to report attacks or simply going out of business.

The challenges for those trying to stem the tide are manifold. Gangs are anonymous, rebranding, and relocating as quickly as the authorities can find them.

Increasingly, they work together to pool specialised knowledge. There are even “initial access” brokers connecting firms which are good at infiltrating systems to others who are better at deploying ransomware once inside.

Perhaps the greatest obstacle is that the countries from which hackers operate, dominated by Russian and former Soviet states, have shown little appetite to stop them. “It might be of benefit to certain states to have these gangs annoying the west, plus the impact is not in the states from which it originates,” says Fairford.

The FSB’s show of strength against REvil, she says, may be little more than theatre, or diplomatic expediency. “I don’t think anybody seriously views this as the beginning of the end of ransomware, at the hands of the Russian state. It’s some sort of token attempt to show movement.”

The only solution, experts agree, is for firms to take every precaution to defend against some of the most well-known weaknesses that ransomware gangs exploit, often via individual staff members.

These include targeting computers used remotely by staff, a growing trend as the pandemic led to more people working from home.

Helge Janicke, research director of the Cyber Security Cooperative Research Centre in Australia, stresses the need for “awareness of your workforce, having effective technical controls and integrating ransomware attacks in your organisation’s incident response and disaster recovery plans”.

“The key is being prepared.”