As the ransomware industry evolves, experts are predicting hackers will only continue to find more and more ways of using the technology to exploit businesses and individuals.
Seksan Mongkhonkhamsao | Moment | Getty Images
Ransomware is now a billion-dollar industry. But it wasn’t always that large — nor was it a prevalent cybersecurity risk like it is today.
Dating back to the 1980s, ransomware is a form of malware used by cybercriminals to lock files on a person’s computer and demand payment to unlock them.
The technology — which officially turned 35 on Dec. 12 — has come a long way, with criminals now able to spin up ransomware much faster and deploy it across multiple targets.
Experts expect ransomware to continue evolving, with modern-day cloud computing tech, artificial intelligence and geopolitics shaping the future.
How did ransomware come about?
The first event considered to be a ransomware attack happened in 1989.
A hacker physically mailed floppy disks claiming to contain software that could help determine whether someone was at risk of developing AIDs.
However, when installed, the software would hide directories and encrypt file names on people’s computers after they’d rebooted 90 times.
It would then display a ransom note requesting a cashier’s check to be sent to an address in Panama for a license to restore the files and directories.
The program became known by the cybersecurity community as the “AIDs Trojan.”
“It was the first ransomware and it came from someone’s imagination. It wasn’t something that they’d read about or that had been researched,” Martin Lee, EMEA lead for Talos, the cyber threat intelligence division of IT equipment giant Cisco, told CNBC in an interview.
“Prior to that, it was just never discussed. There wasn’t even the theoretical concept of ransomware.”
The perpetrator, a Harvard-taught biologist named Joseph Popp, was caught and arrested. However, after displaying erratic behavior, he was found unfit to stand trial and returned to the United States.
How ransomware has developed
Since the AIDs Trojan emerged, ransomware has evolved a great deal. In 2004, a threat actor targeted Russian citizens with a criminal ransomware program known today as “GPCode.”
The program was delivered to people via email — an attack method today commonly known as “phishing.” Users, tempted with the promise of an attractive career offer, would download an attachment which contained malware disguising itself as a job application form.
Once opened, the attachment downloaded and installed malware on the victim’s computer, scanning the file system and encrypting files and demanding payment via wire transfer.
Then, in the early 2010s, ransomware hackers turned to crypto as a method of payment.
In 2013, only a few years after the creation of bitcoin, the CryptoLocker ransomware emerged.
Hackers targeting people with this program demanded payment in either bitcoin or prepaid cash vouchers — but it was an early example of how crypto became the currency of choice for ransomware attackers.
Later, more prominent examples of ransomware attacks that selected crypto as the ransom payment method of choice included the likes of WannaCry and Petya.
“Cryptocurrencies provide many advantages for the bad guys, precisely because it is a way of transferring value and money outside of the regulated banking system in a way that is anonymous and immutable,” Lee told CNBC. “If somebody’s paid you, that payment can’t be rolled back.”
CryptoLocker also became notorious in the cybersecurity community as one of the earliest examples of a “ransomware-as-a-service” operation — that is, a ransomware service sold by developers to more novice hackers for a fee to allow them to carry out attacks.
“In the early 2010s, we have this increase in professionalization,” Lee said, adding that the gang behind CryptoLocker were “very successful in operating the crime.”
What’s next for ransomware?
As the ransomware industry evolves even further, experts are predicting hackers will only continue to find more and more ways of using the technology to exploit businesses and individuals.
Some experts worry AI has lowered the barrier to entry for criminals looking to create and use ransomware. Generative AI tools like OpenAI’s ChatGPT allow everyday internet users to insert text-based queries and requests and get sophisticated, humanlike answers in response — and many programmers are even using it to help them write code.
Mike Beck, chief information security officer of Darktrace, told CNBC’s “Squawk Box Europe” there’s a “huge opportunity” for AI — both in arming the cybercriminals and improving productivity and operations within cybersecurity companies.
“We have to arm ourselves with the same tools that the bad guys are using,” Beck said. “The bad guys are going to be using the same tooling that is being used alongside all that kind of change today.”
But Lee doesn’t think AI poses as severe a ransomware risk as many would think.
“There’s a lot of hypothesis about AI being very good for social engineering,” Lee told CNBC. “However, when you look at the attacks that are out there and clearly working, it tends to be the simplest ones that are so successful.”
Targeting cloud systems
A serious threat to watch out for in future could be hackers targeting cloud systems, which enable businesses to store data and host websites and apps remotely from far-flung data centers.
“We haven’t seen an awful lot of ransomware hitting cloud systems, and I think that’s likely to be the future as it progresses,” Lee said.
We could eventually see ransomware attacks that encrypt cloud assets or withhold access to them by changing credentials or using identity-based attacks to deny users access, according to Lee.
Geopolitics is also expected to play a key role in the way ransomware evolves in the years to come.
“Over the last 10 years, the distinction between criminal ransomware and nation-state attacks is becoming increasingly blurred, and ransomware is becoming a geopolitical weapon that can be used as a tool of geopolitics to disrupt organizations in countries perceived as hostile,” Lee said.
“I think we’re probably going to see more of that,” he added. “It’s fascinating to see how the criminal world could be co-opted by a nation state to do its bidding.”
Another risk Lee sees gaining traction is autonomously distributed ransomware.
“There is still scope for there to be more ransomwares out there that spread autonomously — perhaps not hitting everything in their path but limiting themselves to a specific domain or a specific organization,” he told CNBC.
Lee also expects ransomware-as-a-service to expand rapidly.
“I think we will increasingly see the ransomware ecosystem becoming increasingly professionalized, moving almost exclusively towards that ransomware-as-a-service model,” he said.
But even as the ways criminals use ransomware are set to evolve, the actual makeup of the technology isn’t expected to change too drastically in the coming years.
“Outside of RaaS providers and those leveraging stolen or procured toolchains, credentials and system access have proven to be effective,” Jake King, security lead at internet search firm Elastic, told CNBC.
“Until further roadblocks appear for adversaries, we will likely continue to observe the same patterns.”
People walk past an advertisement for the iPhone 16 Pro at an Apple store during National Day holiday on October 3, 2024 in Chongqing, China.
Cheng Xin | Getty Images News | Getty Images
Apple is offering discounts on its top-end iPhones and other products in China for the upcoming Chinese New Year as the U.S. tech giant faces heightened competition in one of its most crucial markets.
The Cupertino giant is giving customers 500 Chinese yuan ($68.50) off of the iPhone 16 Pro or iPhone 16 Pro Max, and 400 yuan off the iPhone 16 or iPhone 16 Plus. Offers also include discounts for the iPhone 14 and iPhone 15.
For a long time Apple has resisted offering discounts through its own retail channels. Instead, third-party retailers would offer deals at certain times of the year. However, as competition ramps up, Apple has been more inclined in the last year to post seasonal deals.
The firm’s latest challenge has come from a resurgent Huawei and other domestic brands. Apple smartphone shipments fell 6% year-on-year in mainland China in the third quarter of 2024, according to Canalys. The company’s market share also slipped to 14% from 16% a year earlier.
Huawei meanwhile saw shipments jump 24% year-on-year, Canalys data shows, while the company’s market share hit 16% from 13% a year earlier.
Bitcoin was far and away the best-performing asset class in 2024 as new exchange-traded funds ushered in more widespread adoption and hopes for deregulation under a new presidential administration lifted digital assets to record levels.
But owning cryptocurrency also came with its usual unpredictability and dizzying swings, as this month’s trading clearly illustrates. Bitcoin has more than doubled in price since starting the year in the $40,000 range, with it last trading near $95,500. Ether has scored a nearly 50% year-to-date gain, and last traded at around the $3,400 level.
Stock Chart IconStock chart icon
Bitcoin and ether since the start of 2024
The most prosperous stretch of the year occurred in the weeks following the U.S. presidential election. By mid-December, the cryptocurrency had rocketed above $108,000 for the first time, fueled by optimism that President-elect Donald Trump‘s victory over Vice President Kamala Harris would open the door for greater regulatory clarity and send new money rushing into the sector.
Since then, however, prices have eased. Bitcoin is negative for the month, hurt by the expectation that the Federal Reserve’s rate cuts will roll out at a slower-than-anticipated pace. The market has also faced a stretch of apparent profit-taking and choppiness into the end of the year.
The year began with a strong boost of confidence from the introduction in January of new ETFs that hold the cryptocurrency. The funds, which are pitched by asset managers as a simpler way for investors to access bitcoin, have pulled in tens of billions of dollars of cash this year. The iShares Bitcoin Trust ETF (IBIT) now has more than $50 billion in assets.
Stock Chart IconStock chart icon
Microstrategy shares this year
Ether ETFs joined the excitement in July. The demand for those funds has not been as strong as for their bitcoin counterparts, but the category has still attracted more than $2 billion in net inflows in less than six months, according to FactSet.
Strong tail winds for cryptocurrencies also lifted connected stocks to record levels. Bitcoin proxy Microstrategy has surged 388% since the start of the year, while Coinbase and Robinhood have rallied about 47% and 200%, respectively. MicroStrategy shares have surged since mid-December as the company was added into the Nasdaq 100 index.
Some mining stocks, however, haven’t performed as well, with Mara Holdings and Riot Platforms on track for double-digit year-to-date losses. The drop in mining stocks may be a direct result of this year’s bitcoin halving, which reduced the block rewards. Along with transaction fees, this is one of the most significant ways miners make money.
— CNBC’s Jesse Pound contributed reporting.
Don’t miss these cryptocurrency insights from CNBC Pro:
Hock Tan, CEO of Broadcom (L) and former CEO of Intel, Pat Gelsinger.
Reuters | CNBC
It was a big year for silicon in Silicon Valley — but a brutal one for the company most responsible for the area’s moniker.
Intel, the 56-year-old chipmaker co-founded by industry pioneers Gordon Moore and Robert Noyce and legendary investor Arthur Rock, had its worst year since going public in 1971, losing 61% of its value.
The opposite story unfolded at Broadcom, the chip conglomerate run by CEO Hock Tan and headquartered in Palo Alto, California, about 15 miles from Intel’s Santa Clara campus.
Broadcom’s stock price soared 111% in 2024 as of Monday’s close, its best performance ever. The current company is the product of a 2015 acquisition by Avago, which went public in 2009.
The driving force behind the diverging narratives was artificial intelligence. Broadcom rode the AI train, while Intel largely missed it. The changing fortunes of the two chipmakers underscores the fleeting nature of leadership in the tech industry and how a few key decisions can result in hundreds of billions — or even trillions — of dollars in market cap shifts.
Broadcom develops custom chips for Google and other huge cloud companies. It also makes essential networking gear that large server clusters need to tie thousands of AI chips together. Within AI, Broadcom has largely been overshadowed by Nvidia, whose graphics processing units, or GPUs, power most of the large language models being developed at OpenAI, Microsoft, Google and Amazon and also enable the heftiest AI workloads.
Despite having a lower profile, Broadcom’s accelerator chips, which the company calls XPUs, have become a key piece of the AI ecosystem.
“Why it’s really shooting up is because they’re talking about AI, AI, AI, AI,” Eric Ross, chief investment strategist at Cascend, told CNBC’s “Squawk Box” earlier this month.
Intel, which for decades was the dominant U.S. chipmaker, has been mostly shut out of AI. Its server chips lag far behind Nvidia’s, and the company has also lost market share to longtime rival Advanced Micro Devices while spending heavily on new factories.
Intel’s board ousted Pat Gelsinger from the CEO role on Dec. 1, after a tumultuous four-year tenure.
“I think someone more innovative might have seen the AI wave coming,” Paul Argenti, professor of management at Dartmouth’s Tuck School of Business, said in an interview on “Squawk Box” after the announcement.
An Intel spokesperson declined to comment.
Broadcom is now worth about $1.1 trillion and is the eighth U.S. tech company to cross the trillion-dollar mark. It’s the second most valuable chip company, behind Nvidia, which has driven the AI boom to a $3.4 trillion valuation, trailing only Apple among all public companies. Nvidia’s stock price soared 178% this year, but actually did better in 2023, when it gained 239%.
Until four years ago, Intel was the world’s most valuable chipmaker, nearing a $300 billion market cap in early 2020. The company is now worth about $85 billion, just got booted off the Dow Jones Industrial Average — replaced by Nvidia — and has been in talks to sell off core parts of its business. Intel now ranks 15th in market cap among semiconductor companies globally.
‘Not meant for everybody’
Following the Avago-Broadcom merger in 2015, the combined company’s biggest business was chips for TV set-top boxes and broadband routers. Broadcom still makes Wi-Fi chips used in laptops as well as the iPhone and other smartphones.
After a failed bid to buy mobile chip giant Qualcomm in 2018, Broadcom turned its attention to software companies. The capstone of its spending spree came in 2022 with the announced acquisition of server virtualization software vendor VMware for $61 billion. Software accounted for 41% of Broadcom’s $14 billion in revenue in the most recent quarter, thanks in part to VMware.
What’s exciting Wall Street is Broadcom’s role working with cloud providers to build custom chips for AI. The company’s XPUs are generally simpler and less expensive to operate than Nvidia’s GPUs, and they’re designed to run specific AI programs efficiently.
Cloud vendors and other large internet companies are spending billions of dollars a year on Nvidia’s GPUs so they can build their own models and run AI workloads for customers. Broadcom’s success with custom chips is setting up an AI spending showdown with Nvidia, as hyperscale cloud companies look to differentiate their products and services from their rivals.
Broadcom’s chips aren’t for everyone, as only a handful of companies can afford to design and build their own custom processors.
“You have to be a Google, you have to be a Meta, you have to be a Microsoft or an Oracle to be able to use those chips,” Piper Sandler analyst Harsh Kumar told CNBC’s “Squawk on the Street” on Dec. 13, a day after Broadcom’s earnings. “These chips are not meant for everybody.”
While 2024 has been a breakout year for Broadcom — AI revenue increased 220% — the month of December has put it in record territory. The stock is up 45% for the month as of Monday’s close, 16 percentage points better than its prior best month.
On the company’s earnings call on Dec. 12, Tan told investors that Broadcom had doubled shipments of its XPUs to its three hyperscale providers. The most well known of the bunch is Google, which counts on the technology for its Tensor Processing Units, or TPUs, used to train Apple’s AI software released this year. The other two customers, according to analysts, are TikTok parent ByteDance and Meta.
Tan said that within about two years, companies could spend between $60 billion and $90 billion on XPUs.
“In 2027, we believe each of them plans to deploy 1 million XPU clusters across a single fabric,” Tan said of the three hyperscale customers.
In addition to AI chips, AI server clusters need powerful networking parts to train the most advanced models. Networking chips for AI accounted for 76% of Broadcom’s $4.5 billion of networking sales in the fourth quarter.
Broadcom said that, in total, about 40% of its $30.1 billion in 2024 semiconductor sales were related to AI, and that AI revenue would increase 65% in the first quarter to $3.8 billion.
“The degree of success amongst the hyperscalers in their initiatives here is clearly an area up for debate,” Cantor analyst C.J. Muse, who recommends buying Broadcom shares, wrote in a report on Dec. 18. “But any way you slice it, the focus here will continue to be a meaningful boon for those levered to custom silicon.”
Intel’s very bad year
Prior to 2024, Intel’s worst year on the market was 1974, when the stock sank 57%.
The seeds for the company’s latest stumbles were planted years ago, as Intel missed out on mobile chips to Qualcomm, ARM and Apple.
Rival AMD started taking market share in the critical PC and server CPU markets thanks to its productive manufacturing relationship with Taiwan Semiconductor Manufacturing Company. Intel’s manufacturing process has been a notch behind for years, leading to slower and less power-efficient central processing units, or CPUs.
But Intel’s most costly whiff is in AI — and it’s a big reason Gelsinger was removed.
Nvidia’s GPUs, originally created for video games, have become the critical hardware in the development of power-hungry AI models. Intel’s CPU, formerly the most important and expensive part in a server, has become an afterthought in an AI server. The GPUs Nvidia will ship in 2025 don’t even need an Intel CPU — many of them are paired to an Nvidia-designed ARM-based chip.
As Nvidia has reported revenue growth of at least 94% for the past six quarters, Intel has been forced into downsizing mode. Sales have declined in nine of the past 11 periods. Intel announced in August that it was cutting 15,000 jobs, or about 15% of its workforce.
“We are working to create a leaner, simpler, more agile Intel,” board Chair Frank Yeary said in a Dec. 2 press release announcing Gelsinger’s departure.
A big problem for Intel is that it lacks a comprehensive AI strategy. It’s touted the AI capabilities on its laptop chips to investors, and released an Nvidia competitor called Gaudi 3. But neither the company’s AI PC initiative nor its Gaudi chips have gained much traction in the market. Intel’s Gaudi 3 sales missed the company’s own $500 million target for this year.
Late next year, Intel will release a new AI chip that it codenamed Falcon Shores. It won’t be built on Gaudi 3 architecture, and will instead be a GPU.
“Is it going to be wonderful? No, but it is a good first step in getting the platform done,” Intel interim co-CEO Michelle Holthaus said at a financial conference held by Barclays on Dec. 12.
Holthaus and fellow interim co-CEO David Zinsner have vowed to focus on Intel’s products, leaving the fate of Intel’s costly foundry division unclear.
Before he left, Gelsinger championed a strategy that involved Intel both finding its footing in the semiconductor market and manufacturing chips to compete with TSMC. In June, at a conference in Taipei, Gelsinger told CNBC that when its factories get up and running, Intel wanted to build “everybody’s AI chips,” and give companies such as Nvidia and Broadcom an alternative to TSMC.
Intel said in September that it plans to turn its foundry business into an independent unit with its own board and the potential to raise outside capital. But for now, Intel’s primary client is Intel. The company said it didn’t expect meaningful sales from external customers until 2027.
At the Barclays event this month, Zinsner said the separate board for the foundry business is “getting stood up today.” More broadly, he indicated that the company is looking to remove complexity and associated costs wherever possible.
“We are going to constantly be scrutinizing where we’re spending money, making sure that we’re getting the appropriate return,” Zinsner said.