Connect with us

Market Research

New Research Reveals Top Industries Hit by Ransomware

Published

on

The new desk research by NordLocker has discovered which industries are the most popular targets for ransomware gangs to launch their attacks against. After a thorough analysis of 1,200 companies hit by 10 infamous ransomware gangs in 2020 and 2021, 35 of the most victimized industries were identified.

“The latest statistics indicate that a worrying 37% of companies worldwide became victims of ransomware in 2020,” says Oliver Noble, a cybersecurity expert at NordLocker, an encrypted cloud service provider. “From Campari Group in the Food & Beverage industry to Baltimore County public schools in the Education sector, both of which became victims of ransomware last year, no business or institution can feel safe. Our analysis presents the scope of recent ransomware hacks as well as indicates which industries need to stay particularly cautious.”

Top industries hit by ransomware
NordLocker’s analysis reveals that Construction is the top industry hit by ransomware (93 victimized companies), followed by Manufacturing (86). Finance (69 ransomware cases), Healthcare (65), Education (63), Technology & IT (62), Logistics & transportation (59), Automotive (56), Municipal services (52), and Legal (49) are business areas that make the list of the top 10 industries most targeted by ransomware gangs.

Among the hacked companies discovered by NordLocker’s research, there were not only large organizations, such as a global hotel chain, an automotive conglomerate, or a world-wide clothing brand, but also small family-owned and operated businesses like an Italian restaurant or a local dental clinic.

“It is surprising how many companies still undervalue cybersecurity for granted, ‘inviting’ hackers to exploit their vulnerabilities,” says Oliver Noble. “When successfully attacked, companies get all their employee data, customer details, client agreements, patents, and other valuable business information inaccessible and threatened to be stolen, leaked, or destroyed for good. To avoid the doomsday, i.e. having business operations put to a standstill, damaged reputation, loss of clients, tiresome legal battles, and huge fines, some organizations are left with no choice but to pay ransom to get the decryption key.”

However, not many businesses can afford paying hackers off. It is estimated that the average total cost of recovery from ransomware has more than doubled from around $761K in 2020 to $1.85M in 2021. And the most worrying fact is that paying a ransom doesn’t guarantee that you will get back what’s been taken away. There’s also no guarantee your business won’t get attacked again.

Most affected countries
The analysis has found that the top five countries where businesses get attacked most are the US (732 cases), UK (74), Canada (62), France (58), and Germany (39).

According to Oliver Noble, most ransomware gangs come from the post-Soviet states, which still maintain their unfriendliness towards the US and seek to cause harm to both its private and public sectors. On the other hand, French and German economies are dominated by industrial businesses, such as manufacturing, chemical, and automotive. Those industries still tend to take cybersecurity for granted and usually lack robust protection, thus, become easy and lucrative targets for hackers..

Most prolific ransomware operators
The study by NordLocker has analyzed 10 ransomware gang websites. The most prolific ransomware family is Conti, with 450 attacks under their name. REvil (210 hacks), DopplePaymer (200), and PYSA (188) are also among the most famous and active cybercrime groups that harass businesses.

Image

“Internationally operating law enforcement groups work hard to shut ransomware infrastructure down,” says Oliver Noble. “Just last week it was reported that a joint operation put REvil’s servers offline. However, the Russian Ransomware-as-a-Service gang is expected to re-emerge. Ransomware is no longer what only skilled hackers are capable of. Any paying user, aka affiliate with little technical knowledge, can use the subscription-based model to employ already-developed tools to execute ransomware attacks against businesses.”

Cyber Security

Phishing and Scam Hit the Roof in UAE with 230% Increase in Q2 2022: Kaspersky

Published

on

Kaspersky analysis has revealed that attacks related to data loss threats (phishing and scam/social engineering) increased significantly in Q2 2022 at 230% in comparison with the previous quarter in the UAE – the company’s security solutions have detected 3,481,419 phishing attacks in the UAE in Q2.

Social engineering which is sometimes called “human hacking” scams is used in many ways, and for different purposes, to lure unwary users to the site and trick them into entering personal information. The latter often includes financial credentials such as bank account passwords or payment card details, or login details for social media accounts. In the wrong hands, this opens doors to various malicious operations, such as money being stolen or corporate networks being compromised.

Phishing is a strong attack method because it is done on a large scale. By sending massive waves of emails under the name of legitimate institutions or promoting fake pages, malicious users increase their chances of success in their hunt for innocent people’s credentials. Phishers deploy a variety of tricks to bypass e-mail blocking and lure as many users as possible to their fraudulent sites. A common technique is HTML attachments with partially or fully obfuscated code. HTML files allow attackers to use scripts and obfuscate malicious content to make it harder to detect and send phishing pages as attachments instead of links.

According to Kaspersky data, most of Middle East countries saw a staggering increase in attacks related to data loss threats by 159% in the second quarter of 2022 with 15,012,880 phishing scam detections. The highest targeted country was Saudi Arabia with 5,808,946 phishing attacks (a growth by 168%). In particular, while vacation season is high, scammers are trying to lure travellers who are looking for interesting places to go, cheap places to stay and reasonably priced flights. Kaspersky researchers have observed intensified scamming activities, with numerous phishing pages distributed under the guise of airline and booking services. The number of attempts to open phishing pages related to booking and airline services in the first half of 2022 was 4,311 in the META region.

“Planning a vacation is not easy. People can spend weeks, even months, looking for the perfect place to stay and the tickets to get them there. Fraudsters use this to lure users that have grown tired of searching for great deals. After two years of flight restrictions imposed by the pandemic, travelling is back. But so are travel scams – with intensified scamming activity targeting users through fake booking and rental services. Such attacks are totally preventable, which is why we urge users to be sceptical about overly generous offers. If an offer seems too good to be true, it probably is,” comments Mikhail Sytnik, a security expert at Kaspersky.

To keep yourself protected, Kaspersky experts recommend:

  • Carefully look at the address bar before entering any sensitive information, such as your login details and password. If something is wrong with the URL (i.e. spelling, it doesn’t look like the original or it uses some special symbols instead of letters) don’t enter anything on the site. If in doubt, check the certificate of the site by clicking on the lock icon to the left of the URL.
  • Not clicking on links that come from unknown sources (either through e-mails, messaging apps or social networks).
  • Visit the business’ official website if you see a giveaway offered in e-mail or on social media by a travel company or an airline to confirm the giveaway exists. You should also carefully check the links the giveaway ad leads you to.
  • Using a good security solution that can protect you from spam emails and phishing attacks.
Continue Reading

Cyber Security

Cyber Attacks Have Increased Globally by 42% with Ransomware as the Number One Threat

Published

on

Check Point Research (CPR), the Threat Intelligence arm of Check Point Software Technologies Ltd., has released its ‘Cyber Attack Trends: 2022 Mid-Year Report’. The report highlights how cyberattacks have become firmly entrenched as a state-level weapon, including the new ransomware method of ‘Country Extortion’ and state-affiliated hacktivism, and the expansion of ransomware as the number one threat.

Besides insight into the evolution of cyberattacks as a state-level weapon complementing actual military conflict and the elevation of ransomware utilized in nation-state level attacks for financial and social gain, the report also delves into the growth of cloud supply chain attacks through new sources of modules in the open-source community. Up-to-date statistics on the industry and regional cyberattacks as well as advice and predictions for the remainder of 2022 including an analysis of Incident Response exploring the full lifecycle of a cyberattack, presents an integrated view of how cyberattacks have led to major disruption, causing real harm to civic and cyber life in 2022.

“The war in Ukraine has dominated the headlines in the first half of 2022 and we can only hope that it will be brought to a peaceful conclusion soon,” said Maya Horowitz, VP of Research at Check Point Software. “Its impact on cyberspace has been dramatic in both scope and scale, and we have seen huge increases in cyberattacks against organizations in all sectors and all countries this year. Unfortunately, this will only get worse, especially with ransomware now being the number one threat to organizations. However, with the right expertise, strategy and cybersecurity solutions in place, companies are able to prevent attacks from happening.”

Top predictions for H2 highlighted in the report include:

  • Ransomware will become a much more fragmented ecosystem– while ransomware groups have become more structured and operate like regular businesses, with set targets to hit, there will be a lesson learned from the Conti ransomware group, whose size and power garnered too much attention, which led to its downfall. Going forward, we think there will be many small-medium groups instead of a few large ones, to hide in plain sight more effectively.
  • More diverse email infection chains – due to the implementation of internet macros being blocked by default in Microsoft office, the more sophisticated malware families will accelerate the development of new infection chains, with different file types that are password protected to prevent detection as sophisticated social engineering attacks increase.
  • Hacktivism will continue to evolve– hacktivist groups will continue to align their attacks with the agenda of their chosen nation-state, particularly as the Russia-Ukraine war is still ongoing.
  • Continued attacks on decentralized blockchain networks with expected first attacks in Metaverse– with major incidents relating to blockchain platforms, such as a vulnerability on Rarible marketplace or ApeCoin Airdrop vulnerability, we expect to see continued efforts by hackers to breach and hijack crypto assets. In addition, we believe that we will see initial attacks in the Metaverse that will exploit smart contract vulnerabilities.
Continue Reading

Cyber Security

Wipers and IoT Botnets Dominate the Threat Landscape, says Nozomi Networks

Published

on

The latest OT/IoT security report from Nozomi Networks Labs finds wiper malware, IoT botnet activity, and the Russia/Ukraine war impacted the threat landscape in the first half of 2022. Since Russia began its invasion of Ukraine in February 2022, Nozomi Networks Labs researchers saw activity from several types of threat actors, including hacktivists, nation-state APTs, and cyber criminals. They also observed the robust usage of wiper malware, and witnessed the emergence of an Industroyer variant, dubbed Industroyer2, developed to misuse the IEC-104 protocol, which is commonly used in industrial environments.

Additionally, in the first half of 2022, malicious IoT botnet activity was on the rise and growing in sophistication. Nozomi Networks Labs set up a series of honeypots to attract these malicious botnets and capture their activity in order to provide additional insights into how threat actors target IoT. In this research, Nozomi Networks Labs analysts uncovered growing security concerns for both hard-coded passwords and internet interfaces for end-user credentials. From January to June 2022, Nozomi Networks honeypots found:

  • March was the most active month with close to 5,000 unique attacker IP addresses collected.
  • The top attacker IP addresses wereassociated with China and the United States.
  • “root” and “admin” credentials were most often targeted and used in multiple variations as a way for threat actors to access all system commands and user accounts.

On the vulnerability front, manufacturing and energy continue to be the most vulnerable industries followed by healthcare and commercial facilities. In the first six months of 2022:

  • CISA released 560 Common Vulnerabilities and Exposures (CVEs)– down 14% from the second half of 2021
  • The number of impacted vendors went up 27%
  • Affected products were also up 19% from the second half of 2021

“This year’s cyber threat landscape is complex,” said Roya Gordon, Nozomi Networks OT/IoT Security Research Evangelist. “Many factors including increasing numbers of connected devices, the sophistication of malicious actors, and shifts in attack motivations are increasing the risk for a breach or cyber-physical attack. Fortunately, security defenses are evolving too. Solutions are available now to give critical infrastructure organizations the network visibility, dynamic threat detection, and actionable intelligence they need to minimize risk and maximize resilience.”

Nozomi Networks’ “OT/IoT Security Report” provides security professionals with the latest insights needed to re-evaluate risk models and security initiatives, along with actionable recommendations for securing critical infrastructure. This latest report includes:

  • A review of the current state of cybersecurity
  • Trends in the threat landscape, and solutions for addressing them
  • A recap of the Russia/Ukraine crisis, highlighting new related malicious tools and malware
  • Insights into IoT botnets, corresponding IoCs and threat actor TTPs
  • Recommendations and forecasting analysis
Continue Reading
Advertisement


Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.