Microsoft: Over 100 threat actors deploy ransomware in attacks

guest · Jan 31, 2023

By Sergiu Gatlan @serghei - January 31, 2023

Microsoft revealed today that its security teams are tracking over 100 threat actors deploying ransomware during attacks. In all, the company says it monitors over 50 unique ransomware families that were actively used until the end of last year.

"Some of the most prominent ransomware payloads in recent campaigns include Lockbit Black, BlackCat (aka ALPHV), Play, Vice Society, Black Basta, & Royal," Microsoft said.

"Defense strategies, however, should focus less on payloads but more on the chain of activities that lead to their deployment," since ransomware gangs are still targeting servers and devices not yet patched against common or recently addressed vulnerabilities.
Click to expand...

Furthermore, while new ransomware families launch all the time, most threat actors utilize the same tactics when breaching and spreading through networks, making the effort of detecting such behavior even more helpful in thwarting their attacks.

As Redmond added, attackers increasingly rely on tactics beyond phishing to conduct their attacks, with threat actors, such as DEV-0671 and DEV-0882, capitalizing on recently patched Exchange Server vulnerabilities to hack vulnerable servers and deploy Cuba and Play ransomware.
Click to expand...

For instance, a threat actor tracked as DEV-0569, believed to be an initial access broker for ransomware gangs, is now abusing Google Ads in widespread advertising campaigns to distribute malware, steal passwords from infected devices, and ultimately gain access to enterprise networks.

They use this access as part of their attacks or sell it to other malicious actors, including the Royal ransomware gang.

The ransomware as a service (RaaS) ecosystem continues to evolve and expand with numerous players bringing varying techniques, goals, and skillsets. As of end of 2022, Microsoft tracks >50 unique active ransomware families and >100 threat actors using ransomware in attacks.
— Microsoft Security Intelligence (@MsftSecIntel) January 31, 2023
Click to expand...

Meanwhile, LockBit, Hive, Cuba, BlackCat, and Ragnar ransomware operators have kept breaching and trying to extort a steady stream of victims throughout 2022.
Click to expand...

Rasheed187 · Feb 5, 2023

How about redesigning Windows, so that apps/processes don't get full access to just about all folders? Why doesn't M$ ever talk about that?

Log in or Sign up

Microsoft: Over 100 threat actors deploy ransomware in attacks

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Microsoft: Over 100 threat actors deploy ransomware in attacks

guest Guest

Rasheed187 Registered Member

Useful Searches