Monero Usage in Ransomware Payments Rise while Bitcoin Accepted With Premium

cryptonews.com:

Ransomware attackers are increasingly asking for payments in privacy coins like monero (XMR), while still mostly accepting bitcoin (BTC) payments but with a premium, per a new report.

According to the report by CipherTrace, a crypto intelligence company, demanding ransomware payments in XMR has been a trend among attackers in 2021. 

"Most of the groups and strains listed as using XMR are relatively new," the report said. "CipherTrace analysts have observed a trend of increasing use of XMR by darknet markets and ransomware actors."

In total, CipherTrace data revealed that at least 22 ransomware groups, not all of which are currently active, accept only XMR, while another seven accept both BTC and XMR. In total, the analysts found over 50 groups and strains that use XMR, but the list of those using BTC is well over 1,000. 

However, with reported ransomware payments totaling USD 590m in the first half of 2021, ransomware payments where the attackers demanded either BTC or XMR made up just 5.7% (USD 34m) of all transactions, per the report. Meanwhile, payments where attackers demanded only XMR made up just 0.4% (USD 2.4m) of all reported ransomware-related transactions at this time. 

Also, while some attackers only accept XMR, others also accept BTC but charge an additional fee, which is arguably to cover the expenses of making easily traceable BTC transactions anonymous. 

For instance, cybercriminal hacking group DarkSide, which is probably best known for attacking Colonial Pipeline, accepts payments in both BTC and XMR but charges 10% - 20% more for payments in BTC.

Likewise, BlackMatter Ransomware group, a new ransomware group that reportedly has ties to DarkSide, has the same pattern of accepting payments in both BTC and XMR,