Cyber Security
Fortinet Says 78% of Organizations Felt Prepared for Ransomware Attacks, Yet Half Still Fell Victim

Fortinet today unveiled its 2023 Global Ransomware Report. The report is based on a recent global survey conducted by Fortinet and explores cybersecurity leaders’ perspectives on ransomware, particularly how it impacted their organizations in the last year, and their strategies to mitigate an attack. Key findings from the global survey include:
- The global threat of ransomware remains at peak levels, with half of organizations across all sizes, regions, and industries falling victim in the last year.
- The top challenges to stopping a ransomware attack were people and process related, with many organizations lacking clarity on how to secure against the threat.
- There is a range of technologies viewed as essential to prevent ransomware, with an overwhelming majority prioritizing an integrated approach to security.
- Despite the global macroeconomic environment, security budgets will increase in the next year with a focus on AI/ML technologies to speed detection, centralized monitoring tools to speed response, and better preparation of people and processes.
John Maddison, EVP Products and CMO at Fortinet said, “According to the Fortinet research released today, though three out of four organizations detected ransomware attacks early, half still fell victim to them. These results demonstrate the urgency to move beyond simple detection to real-time response. However, this is only part of the solution as organizations cited that the top challenges in preventing attacks were related to their people and processes. A holistic approach to cybersecurity that goes beyond investing in essential technologies and prioritizes training is essential.”
Fortinet’s research revealed there was a large disconnect between respondents’ level of preparedness with existing strategies and their ability to stop a ransomware attack. Although 78% of organizations stated they were “very” or “extremely” prepared to mitigate an attack, the survey found 50% fell victim to ransomware in the last year, and almost half were targeted two or more times. Specifically, four out of the five top challenges to stopping ransomware were people or process related. The second largest challenge was a lack of clarity on how to secure against the threat as a result of a lack of user awareness and training, and no clear chain-of-command strategy to deal with attacks.
The survey also found that despite most (72%) detecting an incident within hours, and sometimes minutes, the percentage of organizations paying ransom remains high, with almost three-quarters of respondents making some form of ransom payment. When comparing across industries, organizations in the manufacturing sector received higher ransoms and were more likely to pay the fee. Specifically, one-quarter of attacks among manufacturing organizations received a ransom of $1M or higher. Finally, while almost all organizations (88%) reported having cyber insurance, almost 40% didn’t receive as much coverage as expected and, in some cases, didn’t receive any because of an exception from the insurer.
With concerns about ransomware still high and despite a challenging global economic environment, nearly all organizations (91%) expect increased security budgets in the next year. Based on the technologies viewed as most essential to secure against ransomware, organizations were most concerned with IoT Security, SASE, Cloud Workload Protection, NGFW, EDR, ZTNA, and Security Email Gateway. When comparing to 2021, the number of respondents citing ZTNA and Secure Email Gateway increased by nearly 20%. Given email phishing remained the most common attack entry method for the second time, it was promising to see respondents view Secure Email Gateway (51%) with higher importance, however, other essential protections, such as Sandboxing (23%) and Network Segmentation (20%) remained low on the list.
In the future, the top priorities for respondents will be investing in advanced technology powered by AI and ML to enable faster threat detection and central monitoring tools to speed response. These investments will help organizations combat a rapidly evolving threat landscape as cyber attackers become more aggressive and deploy new elements into attacks.
In addition, the report found that organizations using point products were the most likely to fall victim to an attack in the last year, while those who had consolidated to a smaller number of platforms were the least likely to be a victim. Further, almost all respondents (99%) viewed integrated solutions or a platform as essential to preventing ransomware attacks. These findings underscore the importance of leveraging a unified platform approach to defend against ransomware.
Cyber Security
A Total of 13 Organizations in 9 Countries Fall Victim to “Dark Pink”

Group-IB has today published a new update into the APT (advanced persistent threat) group codenamed Dark Pink, revealing that a total of 13 organizations in 9 countries have now fallen victim to this malicious actor. Dark Pink’s operations were detailed in depth by Group-IB’s Threat Intelligence unit in a January 2023 blog post, and at this time, researchers linked the group to attacks on 7 organizations in the Asia-Pacific region and 1 in Europe. Group-IB experts have since discovered 5 new Dark Pink victims, and the geographic scope of the group’s operations is wider than previously thought, as organizations in Brunei, Thailand, and Belgium were all hit by Dark Pink attacks.
Continued analysis has revealed that this group is still active, as Dark Pink attacked a government ministry in Brunei this past January and a government agency in Indonesia as recently as April 2023. Additionally, Group-IB researchers were able to attribute three other attacks from 2022 to this particular APT group. The initial access vector for Dark Pink attacks continues to be spear-phishing emails, and Group-IB researchers noted in their January 2023 blog that the group utilized an almost-entirely custom toolkit to exfiltrate files and messenger data from infected devices and networks.
Since then, Group-IB experts can reveal that Dark Pink APT has updated many of these custom tools, changing their functionalities in order to allow the group to slip undetected past defense mechanisms of cybersecurity systems. For example, the group’s custom KamiKakaBot module, designed to read and execute commands from the threat actors via Telegram, is still stored on the filesystem of infected devices, but it is now divided into two distinct parts — one that controls the device and the other that steals sensitive data. Dark Pink also continues to use an MSBuild utility to launch KamiKakaBot in the infection chain.
Group-IB’s Threat Intelligence unit has discovered Dark Pink’s new account on GitHub, which was created as soon as the first information about the APT group was published in the public domain this past January. The threat actors can issue commands to infected machines to download files from this GitHub account, and Group-IB researchers found 12 commits to the new account performed between January 9 and April 11, 2023.
Recent attacks have also seen the group exfiltrate stolen data over a HTTP protocol using Webhook service, and they have also leveraged functionalities of an MS Excel add-in to ensure the persistence of TelePowerBot (a simpler version of KamiKakaBot written in PowerShell). In line with Group-IB’s zero-tolerance policy to cybercrime, all confirmed and potential victims of Dark Pink attacks were issued with proactive warnings.
“Dark Pink APT shows no sign of slowing down,” Andrey Polovinkin, Malware Analyst at Group-IB, said. “APT groups are renowned for their responsiveness and ability to adapt their custom tools to continually avoid detection, and Dark Pink is no exception. The profile of the affected targets underscores the significant danger that Dark Pink poses for both public- and private-sector actors. Group-IB will continue to analyze all Dark Pink activity and ensure that confirmed and potential victims are informed.”
Cyber Security
Acronis Launches Endpoint Detection and Response

Acronis has announced the general availability of Acronis Advanced Security + Endpoint Detection & Response (EDR) for Acronis Cyber Protect Cloud. With new capabilities such as AI-based attack analysis, Acronis EDR reduces complexity and simplifies workflows for a more streamlined operation, making it easier than ever for MSPs and the businesses they serve to deploy comprehensive security and data protection. With more organizations turning to MSPs for their backup and security needs, and with a greater need for simplicity and efficiency, Acronis EDR aims to expand the adoption of advanced security capabilities, helping organizations of all sizes better protect themselves.
“With the proliferation of endpoints and increasing frequency of cyber threats, EDR has become a mission-critical tool in incident response and the fight for data protection. But solutions that are difficult to deploy and maintain are an obstacle,” said Research Vice President of Security and Trust Michael Suby at IDC. “The best solutions deliver the advanced security of EDR and meet the needs of the IT professionals who use it. That means easy deployments and rapid detection, response, and recovery with AI and automation on board.”
Acronis EDR offers the broadest number of out-of-the-box recovery options that take advantage of the integration with Acronis Cyber Protect’ backup and recovery, endpoint management, and endpoint security capabilities. Designed for Managed Service Providers (MSPs), it allows them to quickly and easily analyze and prioritize security incidents, minimize downtime, and maintain business continuity while keeping their clients safe and protected.
“Other EDR tools can be over-complicated and force MSPs into expensive, time-consuming processes to implement and understand. Acronis EDR delivers a robust EDR solution that is easy to deploy and use while following industry-established standards like the NIST cybersecurity framework and mapping to the MITRE ATT&CK framework,” said Candid Wüest, VP of Research at Acronis. “By rapidly understanding attack analysis and impact, Acronis EDR users can quickly evaluate a potential threat, gain insight into how an attacker gained access, what damage was caused, and how the attack might spread.”
Acronis EDR delivers:
- Optimized Incident Analysis to quickly and easily analyze and prioritize security incidents and potential attacks without relying on costly security expertise or time-consuming processes.
- Integrated Security with Backup & Recovery, for comprehensive protection critical to minimizing downtime and maintaining business continuity in the event of an attack.
- A Complete Cyber Protection Solution in a single agent — simple for MSPs to deploy, manage, and scale — that eliminates the cost, complexity, and security gaps inherent in multiple-point solutions.
“As a cybersecurity expert, I have witnessed firsthand the evolution of EDR and how it has revolutionized the way we approach security,” said Eric O’Neill, former FBI counterintelligence operative. “EDR allows security personnel to efficiently investigate, remediate, and recover from potential incidents while also reducing the attack surface and threat actor dwell time. The latest advances in EDR technology allow for rapid analysis of attack changes, shortened time to respond to incidents, and better business continuity for all organizations.”
Artificial Intelligence
Fake ChatGPT Apps Scam Users Out of Thousands of Dollars, Says Sophos

Sophos has announced that it had uncovered multiple apps masquerading as legitimate, ChatGPT-based chatbots to overcharge users and bring in thousands of dollars a month. As detailed in Sophos X-Ops’ latest report, “’FleeceGPT’ Mobile Apps Target AI-Curious to Rake in Cash,” these apps have popped up in both the Google Play and Apple App Store, and, because the free versions have near-zero functionality and constant ads, they coerce unsuspecting users into signing up for a subscription that can cost hundreds of dollars a year.
“Scammers have and always will use the latest trends or technology to line their pockets. ChatGPT is no exception. With interest in AI and chatbots arguably at an all-time high, users are turning to the Apple App and Google Play Stores to download anything that resembles ChatGPT. These types of scam apps—what Sophos has dubbed ‘fleeceware’—often bombard users with ads until they sign up for a subscription. They’re banking on the fact that users won’t pay attention to the cost or simply forget that they have this subscription. They’re specifically designed so that they may not get much use after the free trial ends, so users delete the app without realizing they’re still on the hook for a monthly or weekly payment,” said Sean Gallagher, principal threat researcher, Sophos.
In total, Sophos X-Ops investigated five of these ChatGPT fleeceware apps, all of which claimed to be based on ChatGPT’s algorithm. In some cases, as with the app “Chat GBT,” the developers played off the ChatGPT name to improve their app’s ranking in the Google Play or App Store. While OpenAI offers the basic functionality of ChatGPT to users for free online, these apps were charging anything from $10 a month to $70.00 a year. The iOS version of “Chat GBT,” called Ask AI Assistant, charges $6 a week—or $312 a year—after the three-day free trial; it netted the developers $10,000 in March alone. Another fleeceware-like app, called Genie, which encourages users to sign up for a $7 weekly or $70 annual subscription, brought in $1 million over the past month.
The key characteristics of so-called fleeceware apps, first discovered by Sophos in 2019, are overcharging users for functionality that is already free elsewhere, as well as using social engineering and coercive tactics to convince users to sign up for a recurring subscription payment. Usually, the apps offer a free trial but with so many ads and restrictions, they’re barely useable until a subscription is paid. These apps are often poorly written and implemented, meaning app function is often less than ideal even after users switch to the paid version. They also inflate their ratings in the app stores through fake reviews and persistent requests of users to rate the app before it’s even been used or the free trial ends.
“Fleeceware apps are specifically designed to stay on the edge of what’s allowed by Google and Apple in terms of service, and they don’t flout the security or privacy rules, so they are hardly ever rejected by these stores during the review. While Google and Apple have implemented new guidelines to curb fleeceware since we reported on such apps in 2019, developers are finding ways around these policies, such as severely limiting app usage and functionality unless users pay up. While some of the ChatGPT fleeceware apps included in this report have already been taken down, more continue to pop up—and it’s likely more will appear. The best protection is education. Users need to be aware that these apps exist and always be sure to read the fine print whenever hitting ‘subscribe.’ Users can also report apps to Apple and Google if they think the developers are using unethical means to profit,” said Gallagher.