Why ransomware attacks are growing more targeted

guest · Mar 1, 2019

Why ransomware attacks are growing more targeted
March 1, 2019
https://www.techrepublic.com/article/why-ransomware-attacks-are-growing-more-targeted/

While ransomware attacks decreased in 2018, they also became much more targeted, according to the 2019 Webroot Threat Report released Thursday.
The report analyzed the most prominent cybersecurity threats over the course of 2018, showing organizations where to exercise the most caution this year.

"We wax poetic about innovation in the cybersecurity field, but you only have to take one look at the stats in this year's report to know that the true innovators are the cybercriminals," said Hal Lonas, CTO of Webroot, in a press release.

One of the most popular attack vectors of 2018 utilized Remote Desktop Protocol (RDP) connections, using tools such as Shodan to locate systems with faulty or inadequate RDP settings, the report found.
In addition to ransomware threats, the report also detected an increase in cryptomining and cryptojacking techniques.
Click to expand...

2019 Webroot Threat Report (PDF - 3.92 MB): https://www-cdn.webroot.com/9315/5113/6179/2019_Webroot_Threat_Report_US_Online.pdf

guest · Apr 10, 2019

Ransomware getting more targeted, warns Flashpoint
April 8, 2019
https://www.computerweekly.com/news/252461286/Ransomware-getting-more-targeted-warns-Flashpoint

Ransomware is steadily shifting from opportunistic attacks to targeted attacks, according to researchers at security firm Flashpoint.

He believes the willingness of organisations to pay ransom to get back access to their files and restart business operations is giving ransomware threat actors motivation to shift to targeted attacks.
With this shift comes changes when in their tools, techniques and procedures,” said Elisan.
For example, opportunistic attack ransomware typically uses Tor sites that contain information on how to pay ransom and communicate with the threat actors, but these sites can be viewed by anybody who has the link.

As a result, attackers are changing the way they communicate with the victims as they shift to more targeted attacks.
“The effects of ransomware can also be fatal. Imagine a healthcare provider whose life support equipment relies on systems that are compromised by ransomware and as a result ceases to function.”
Click to expand...

Flashpoint: Threat Actors Shifting from Opportunistic to Targeted Ransomware

guest · May 21, 2019

Ransomware Not Gone but More Targeted, Report Says
May 21, 2019
https://www.infosecurity-magazine.com/news/ransomware-not-gone-but-more-1/

Cyber-criminals continue to grow more sophisticated, developing advanced attack methods, including tailored ransomware, according to the Q1 Global Threat Landscape Report, published today by Fortinet. In addition to targeted attacks, criminals are also using custom coding, living-off-the-land (LotL) and sharing infrastructure to maximize their opportunities, the report said.

Ransomware “is being customized for high-value targets and to give the attacker privileged access to the network. LockerGoga is an example of a targeted ransomware conducted in a multi-stage attack.
Researchers also detected an uptick in malicious actors leveraging dual-use tools, preinstalled on targeted systems to carry out cyber-attacks.
Click to expand...

Fortinet: Global Threat Landscape Report Q1 2019 (PDF - 4.35 MB): https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/threat-report-q1-2019.pdf
Key Takeaways from Our Latest Global Threat Landscape Report

guest · May 22, 2019

Satan Ransomware Adds More Evil Tricks
May 21, 2019
https://www.darkreading.com/vulnera...nsomware-adds-more-evil-tricks/d/d-id/1334779

The operators and developers behind a 2-year-old ransomware framework, dubbed Satan, continue to expand the codebase, adding exploits for the Spring Web application framework, the ElasticSearch search engine, and ThinkPHP Web application framework popular in China, according to research from Fortinet.
The incorporation of three new exploits into the Satan ransomware framework highlights the continuing improvement in capabilities incorporated into the malicious software by operators and developers.

"I would put money on the fact that we will see more targeted attacks that are using ransomware," Giandomenico says. "It will be multistaged. They may do other things on the network first, and when they are finished, they will slap some ransomware in there to cover their tracks" or convert the compromise to cash.
Click to expand...

guest · May 25, 2019

Targeted Ransomware Has Changed the Face of Incident Response
May 23, 2019
https://www.flashpoint-intel.com/blog/targeted-ransomware-has-changed-the-face-of-incident-response/

It’s becoming increasingly rare to publicly learn about ransomware attacks carried out at any kind of scale.
Complicating matters further is the overbearing truth that traditional incident response has never been applicable to ransomware attacks; the dynamic is that much different.

Traditional incident response is a predetermined path for addressing and managing a network breach or incident, with the aim of keeping damage and expenses in check, and reducing recovery time.
Ransomware, however, throws a nasty wrinkle into that methodology.
A New Layer of Response
Some companies aren’t as vigilant about backup and quickly run up against a new layer of incident response for them: the need to communicate and coordinate with a threat actor in order to recover files and pay the ransom if they so choose.
Many times, that type of expertise isn’t in the wheelhouse of an enterprise’s incident response team, most of which are prepared for dealing with infections and lean on support from endpoint security vendors for updated signatures to assist in prevention and remediation.
Click to expand...

guest · Jul 18, 2019

Targeted Ransomware: Proliferating Menace Threatens Organizations
July 18, 2019
https://www.symantec.com/blogs/threat-intelligence/targeted-ransomware-threat

Targeted ransomware has quickly become one of the most dangerous cyber crime threats facing organizations. Over the past two years, the number of organizations being hit with targeted ransomware attacks has multiplied as the number of gangs carrying out these attacks has proliferated.

The affected organization could have its operations severely disrupted, losing access to vital data and services.
In a new white paper, published today, Symantec has found that the number of organizations being attacked by targeted ransomware has grown rapidly since the beginning of 2018.
Robust defenses needed
A ransomware attack that involves encryption of hundreds of computers and servers is probably one of the most disruptive and costly forms of cyber attack any organization could experience. The hastening pace of targeted ransomware attacks over the past 12 months means that organizations need to educate themselves about this threat and ensure that robust, overlapping defenses are in place.
Click to expand...

guest · Aug 7, 2019

Vectra: Ransomware attacks are spreading to cloud, datacenter, and enterprise infrastructure
August 7, 2019
https://venturebeat.com/2019/08/07/...ud-data-center-and-enterprise-infrastructure/

The Vectra 2019 Spotlight Report on Ransomware finds that the most significant ransomware threat — in which hackers steal your data and hold it for ransom — is malicious encryption of shared network files in cloud service providers. San Jose, California-based Vectra released the report ahead of the Black Hat 2019 security conference in Las Vegas this week.

“The fallout from ransomware attacks against cloud service providers is far more devastating when the business systems of every cloud-hosted customer are encrypted,” said Chris Morales, head of security analytics at Vectra, in a statement.
“Today’s targeted ransomware attacks are an efficient, premeditated criminal threat with a rapid close and no middleman.”
The report disclosed that cybercriminals’ most effective weapon in a ransomware attack is the network itself, which enables the malicious encryption of shared files on network servers, especially files stored in infrastructure-as-a-service (IaaS) cloud providers.

The Attacker Behavior Industry Report provides statistical data on the behaviors motivated attackers use to blend in with existing network traffic behaviors and mask their malicious actions.
Click to expand...

guest · Sep 6, 2019

Best Practices in Targeted Ransomware Attacks
Against the backdrop of increasing attacks, here’s how to prepare with a bold response playbook and ransomware jump kit
September 3, 2019
https://www.symantec.com/blogs/expert-perspectives/best-practices-targeted-ransomware-attacks

Soon after Symantec released its July 2019 white paper documenting a 400% increase in targeted ransomware attacks over the past two-and-a-half years, a colleague came to me with a tough question about prevention. Apart from following basic security protocols like updating software and installing the file-based ransomware barriers listed in the report, she asked, ”Can companies avoid being targeted in the first place?”

Sadly, my answer was unequivocal: “No. We haven’t cracked the criminals’ minds and so can’t predict what motivates emergent ransomware gangs such as GoGalaker and Megacortez to target one organization over another. But, considering the current ransomware attack rate of 50 enterprises a month, plenty of corporate teams could be better prepared.”
While there are certainly no fail-safe solutions for ransomware, or most things in life, I offer three experience-based suggestions: [...]
Click to expand...

guest · Oct 15, 2019

Targeted Ransomware Attacks Show No Signs of Abating
Criminals are becoming more sophisticated and targeted in going after enterprise organizations, a new Q2/Q3 report finds
October 15, 2019
https://www.darkreading.com/attacks...tacks-show-no-signs-of-abating/d/d-id/1336095

Emsisoft recently analyzed threat data from the second and third quarters of this year and found ransomware attacks have become more focused and targeted. The success some attackers have had in extorting ransoms from enterprise targets appears to have spawned more concerted efforts by others to do the same.

"While the total number of ransomware attacks has declined, there has been a significant increase in the number of high-impact attacks targeting companies and public entities," says Fabian Wosar, CTO at Emsisoft.
The most visible example of the trend was Sodinokibi, a ransomware-as-a-service threat used by multiple groups in targeted attacks on various major organizations in Q2 and Q3.
Emsisoft detected significantly larger volumes of attack traffic associated with other ransomware strains. The most commonly reported ransomware strain in the previous two quarters, for instance, was STOP, aka DJVU, which accounted for 56% of all submissions.

Emsisoft's analysis showed that US organizations are among the most heavily targeted in ransomware attacks.
Click to expand...

Emsisoft: Ransomware statistics for 2019: Q2 to Q3 report

guest · Nov 20, 2019

Ransomware Gangs Adopt APT Tactics in Targeted Attacks
November 20, 2019
https://www.bleepingcomputer.com/ne...-gangs-adopt-apt-tactics-in-targeted-attacks/

Fast forward to the end of 2018 and through 2019. We now see that ransomware operators are joining forces with specialized affiliates or partners who have the skills needed in targeted attacks that require network-wide access.
APT + Ransomware = $$$
In a new report by cybersecurity and intelligence firm AdvIntel, we explore how ransomware operators are partnering with actors who utilize APT methods to gain access to networks and perform network-wide ransomware attacks or supply-chain attacks.
AdvIntel has noticed a new trend where network breach actors are starting to partner with ransomware operators either as affiliates or by selling them access to the controlled networks for as little as $1,000 to $5,000.

"At this point, ransomware collectives act as patrons. Being on the top of the underground food-chain, they hunger for expansion and conquest of new realms. They know how resourceful a supply-chain breach can be when it comes to locking multiple systems and are eager to invest in the rising talents which can lead them to even further success. [...]"
Click to expand...

AdvIntel: Digital "Pharmacusa": Supply-Chain Attacks for Ransomware Intrusions

guest · Mar 6, 2020

Why Is Targeted Ransomware So Dangerous?
March 6, 2020
https://businessinsights.bitdefender.com/why-is-targeted-ransomware-so-dangerous

Targeted ransomware is the result of a complex process that involves more than just the initial infection – and it presents more challenges than a regular incident.
While it’s riskier, a higher reward is expected if the attack succeeds. Having a hacking group concentrated on a single company requires a much more focused response, which can drain resources.

Forgetting to patch known vulnerabilities in RDP is also a common mistake exploited by threat actors.
Phishing campaigns, especially targeted ones, rely on poorly trained employees who click on the wrong link or open tainted email attachments.
Hackers who deploy targeted ransomware are also more likely to ask for a reward that’s closer to what the company can afford to pay since attackers usually observe their targets long before the actual infection.

There’s no sure way to protect a company against targeted ransomware, but such cyber security incidents can mostly be avoided by training people to recognize the signs of a ransomware attack, to deploy the right protection for the company, to maintain backups for critical systems, and to keep all software and hardware up to date.
Click to expand...

guest · Apr 26, 2021

Targeted ransomware attacks grow 767%, India among top targets
April 26, 2021
https://ciso.economictimes.indiatim...cks-grow-767-india-among-top-targets/82251883

The ransomware attacks on high-profile targets such as corporations, government agencies and municipal organisations globally increased by a whopping 767 per cent in one year (from 2019 to 2020), according to a new report.

Targeted ransomware attacks have become a major concern globally in the past few years, especially for organisations and businesses in the APAC region, especially India.

"At least 61 entities from the region were breached by a targeted ransomware group in 2020. Australia and India being the top two countries that logged the highest number of incidents across APAC," said Chris Connell, Managing Director, Kaspersky (APAC).
Targeted ransomware attacks involve significantly more sophistication (network compromise, reconnaissance and persistence, or lateral movement) and a much larger payout.
Click to expand...

guest · Sep 3, 2022

New Agenda Ransomware appears in the threat landscape
By Pierluigi Paganini - August 28, 2022

Trend Micro researchers recently discovered a new piece of targeted ransomware, tracked as Agenda, that was written in the Go programming language. The ransomware was employed in a targeted attack against one of the company’s customers. The investigation into the incident revealed that threat actor used a public-facing Citrix server as a point of entry, they likely used a valid account to access this server and perform lateral movements inside the victim’s network.

The new ransomware family was employed in attacks that hit enterprises in Asia and Africa. The name Agenda comes from dark web posts by a user named “Qilin,” who is likely linked to the ransomware distributors, and through ransom notes.
Click to expand...

The collected samples were 64-bit Windows PE (Portable Executable) files and were used to target healthcare and education organizations in Indonesia, Saudi Arabia, South Africa, and Thailand.

“Every ransomware sample was customized for the intended victim. Our investigation showed that the samples had leaked accounts, customer passwords, and unique company IDs used as extensions of encrypted files.” reads the report published by Trend Micro. “Also, the ransom amount requested is different per company, ranging from US$50,000 to US$800,000.”
Click to expand...

Trend Micro: New Golang Ransomware Agenda Customizes Attacks

A new ransomware written in the Go language has been targeting healthcare and education enterprises in Asia and Africa. This ransomware is called Agenda and is customized per victim.
Click to expand...

Log in or Sign up

Why ransomware attacks are growing more targeted

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why ransomware attacks are growing more targeted

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches