Monero (XMR), which jumped 22% in 7 days, becomes ‘darling’ in ransomware payments

Privacy-focused cryptocurrency Monero (XMR), which has gained more than 22% in the last week with confirmation of a hard fork in July, has become the “darling” of cybercriminals promoting ransomware attacks.

According to a recent report by intelligence firm CipherTrace, ransomware attackers increasingly demanded XMR payments in 2021. Naturally, they continue to accept the biggest cryptocurrency on the market, BTC.

Ransomware is a type of malware that aims to restrict access to the infected system. The attackers then charge a ransom in cryptocurrencies to restore access.

Monero (XMR) for ransomware payments

According to the report, most cybercriminal groups asking for “ransoms” in Monero are relatively new.” In total, there are at least 22 ransomware groups that only accept XMR as payment. Meanwhile, another seven accept BTC and XMR.

In addition, CipherTrace analysts found a total of over 50 groups that use XMR. It is worth noting that the list of those who require payments in BTC is well over 1,000.

“BTC remains the preferred payment system. But Monero (XMR) has risen sharply in adoption by ransomware groups.”

The report also points out that while some ransomware groups only require XMR, others offer the possibility of payment in BTC as well. However, they charge an “extra fee” if the victim chooses to pay in BTC.

“The higher prices for BTC are likely seen by ransomware actors as a reward for dealing with the increased risk of using an easily traceable cryptocurrency like BTC,” explain the CipherTrace researchers.

DarkSide, the group behind the Colonial Pipeline attack, for example, accepts BTC and XMR. However, it charges a 10-20% higher price for BTC payments.

Likewise, the BlackMatter Ransomware group, a new group that is allegedly linked to DarkSide, has the same BTC and XMR payment acceptance scheme, with ransom payments in BTC 25% more expensive.

Use of cryptocurrencies is not expressive

In any case, cryptocurrency payments in ransomware attacks are not so expressive.

In the first half of 2021, reported ransomware payouts totaled $590 million. However, payments where attackers demanded BTC or XMR only accounted for 5.7% of all transactions.

Payments where attackers only required XMR accounted for just 0.4% of all transactions. The likely reason for the increase is the hard fork scheduled for July 16, which will update the privacy and overall performance of the Monero network.