Ransomware has become a burning concern to every office in the world which wasn't even existing 30 years before. Probably there was never a danger of this kind. The fact that the ransomware gets stronger day by day, is the most profound concern.
Current revelations show how diabolical the threat of ransomware is. In 2020, attacks rose by 715%, as opponents rejected the Covid-19 epidemic disruption to trap victims down with their guard. In addition to being more offensive, threat actors were much more reluctant to threaten the following: A patient was killed by a ransomware attack in the equipment gear that kept him alive in a German hospital and a California university was paying over $1 million to get back the IT online. In contrast to the unnamed impact on the country's economy, the Colonial Pipeline attack showed various weaknesses in US energy infrastructure.
The whole strategy seems to work since the ransomware payments increased by 100% in 2020. There are no signs of ransomware attacks being curbed, as an Apple supplier also became a victim of a $50 million ransom demand. If ransomware was known to be alarming, it now took on a genuinely frightening character. And none of the organizations can find themselves as immune against it.
This does not imply, that everyone has the same chance of a successful intrusion with ransomware. Indeed, that is what makes businesses most vulnerable – one that sees ransomware as unavoidable and unstoppable, one believes that the situation is bleak, instead of upgrading their security plan to keep up with developments in ransomware.
At least throughout their early phases, the surge of attacks in 2020 seemed to be more like the attacks in the past years. Attackers would then use a phishing attempt to access an IT network and exploit certain known/unknown vulnerabilities.
Following this initial violation, the automatic propagation methods were introduced gradually. Currently, however, a single goal is no longer enough. Ultimately, a change to operative human ransomware will occur that does not take small networks into account.
Today's ransomware attacks travel across organizations by seeking information with high privileges. It aims at hitting the largest number of machines – i.e. maximizing damage. The safety department needs to prioritize the prevention of these lateral movements - and not just to spot them. Any ransomware attack might otherwise be cut so thoroughly that it is difficult to reverse.
Instead of being dependent on malware to push the attack, ransomware managed by humankind is equipped with an operator to guide it towards the most effective goal possible through resistance mechanisms and protection. These attacks are more persistent, much more powerful, and more damaging.
Spear phishing attacks are now the preferred method for the distribution of ransomware. Opponents choose a target and then tailor the email to sound as credible as possible. This dramatically contrasts with daily phishing, which means that large-scale e-mails are sent to vast lists of native contacts. Disputed users instead click on a connection or download an accessory that causes the infection of malware.
Spear phishing operations are also becoming advanced: cybercriminals are sending spear-phishing email addresses that look just like licensed senders with domain spoofing techniques.
In the face of this challenge, AV and EDR are destined to fail a cybersecurity plan. It may already be too late whenever these defenses kick in. This is the best advice: evolve or die. The only protection that succeeds is prevention. This means that one must follow a proactive cyber safety approach that focuses on zero trusts, reduces the attack surface, and, of course, moves goal protection.
