Cyber experts urge resilience amid rise in sophisticated ransomware
Organisations across the world are being urged to step up their defences against ransomware threats, as cybercriminals continue to disrupt businesses, public services and essential infrastructure. Anti-Ransomware Day, which takes place annually on 12 May, serves as a touchstone for reflection and action, highlighting the need for both prevention and robust response strategies in the face of escalating attacks. Marking the anniversary of the notorious WannaCry outbreak in 2017, the occasion is backed by Interpol and cybersecurity company Kaspersky.
Experts have warned that the nature of ransomware is more sophisticated and damaging than ever before, as demonstrated by recent incidents affecting major retailers including M&S. The company was reportedly hit by the DragonForce ransomware group in April, an event that led to disruption across payment, online order, and Click & Collect services, with significant repercussions for its share price and overall valuation.
Sam Peters, Chief Product Officer at ISMS.online, described the M&S incident as indicative of the evolving and increasingly advanced tactics perpetrators use. "Ransomware attacks are becoming more sophisticated than ever before, with hackers increasingly adopting social engineering, double extortion, and artificial intelligence-based tactics to inflict greater damage on victims and scale their nefarious activities," Peters observed. He advocates for a "layered cybersecurity approach" and a "company-wide coordinated defence strategy," highlighting that businesses must move beyond single solutions and develop multi-faceted strategies, including managed detection and response services, data backups, and comprehensive staff training.
Echoing this sentiment, Edward Lewis, CEO of CyXcel, argued that ransomware has developed into a highly professionalised and potent threat, capable of wreaking havoc and extorting vast sums from its victims. Lewis drew attention to recent law enforcement efforts targeting gangs such as BlackCat and LockBit, but cautioned that these interventions have yet to halt the global rise in attacks. He pointed to the UK Government's ransomware payment ban proposals as evidence of a policy shift designed to fracture the criminal business model and foster greater resilience. "The focus now must shift to resilience," Lewis insisted. "Being proactive, planning ahead, and ensuring that critical systems can withstand disruption so that if the worst does happen, they get back on their feet quickly and that existential threat doesn't put an end to their business altogether."
The professionalisation and industrialisation of ransomware was also underscored by Brad Maule-ffinch, Event Director at Infosecurity Europe, who observed the growth of Ransomware-as-a-Service (RaaS) as a key enabler for less technically skilled criminals to launch effective attacks. He described ransomware as not merely a technical issue but a "societal challenge" requiring unified action from government, industry, and law enforcement. "Events like Infosec play a crucial role in bringing those voices together to help build a more secure and resilient digital future and a safer cyber world," Maule-ffinch affirmed.
Resilience and recovery remain central themes, according to Jon Fielding, Managing Director EMEA at Apricorn. Fielding referenced survey results showing a rising risk — with 31% of UK respondents suffering an attack in 2024, compared with 24% the previous year. He stressed the importance of stringent backup procedures, advocating the established 3-2-1 approach: three copies of data, on two types of media, with one stored offsite. "Building resilience through proactive measures and reliable backup strategies not only mitigates the immediate impact of ransomware incidents but also contributes to a broader deterrent effect and enhances overall security posture," Fielding said.
Industry consensus is clear: while regulatory moves such as ransom payment bans and enhanced reporting obligations mark important steps, technical innovation by cybercriminals and the widespread use of ransomware tools mean that organisations must take proactive, collective responsibility. Building cyber resilience, integrating risk management at every leadership level, and embedding best practices throughout organisations are widely seen as key to reducing both the frequency and impact of such attacks.
