Record number of ransomware attacks

Zscaler has released the findings of its annual ThreatLabz Ransomware Report, which revealed an 80 per cent increase in ransomware attacks year-over-year. In 2022, the most prevalent ransomware trends include double-extortion, supply chain attacks, ransomware-as-a-service, ransomware rebranding, and geo-political incited ransomware attacks. The report analyses over a year’s worth of data from the largest security cloud in the world, which processes more than 200 billion daily transactions and 150 million daily blocked attacks across the Zscaler Zero Trust Exchange. The report details which industries are being targeted the most by cybercriminals, explains the damage caused by double-extortion and supply chain attacks, and catalogues the most active ransomware groups operating today.

“Modern ransomware attacks require a single successful asset compromise to gain initial entry, move laterally, and breach the entire environment, making legacy VPN and flat networks extremely vulnerable,” said Deepen Desai, CISO of Zscaler. “Attackers are finding success exploiting weaknesses across businesses’ supply chains as well as critical vulnerabilities like Log4Shell, PrintNightmare, and others. And with ransomware-as-a-service available on the darkweb, more and more criminals are turning to ransomware, realising that the odds of receiving a big payday are high.”

The tactics and scope of ransomware attacks have been steadily evolving, but the end goal continues to be a disruption of the target organisation and theft of sensitive information for the purposes of ransom. The size of the ransom often depends on the number of systems infected and the value of the data stolen: the higher the stakes, the higher the payment. In 2019, many ransomware groups updated their tactics to include data exfiltration, commonly referred to as a ‘double extortion’ ransomware. A year later, select groups added another attack layer with distributed denial of service (DDoS) tactics that bombard the victim’s website or network, creating more business disruption, thus pressuring the victim to negotiate.

This year, the most dangerous ransomware trend involves supply chain attacks that target a supplier's business and use established connections and shared files, networks, or solutions for second-stage attacks on that supplier’s customers. ThreatLabz also noted nearly a 120 per cent increase in double-extortion ransomware victims based on data published on threat actors’ data leak sites.

For the second year in a row, manufacturing companies were the most targeted with nearly one in five ransomware attacks directed at manufacturers. However, attacks on other sectors are rapidly growing. The growth rate of attacks on healthcare companies was particularly striking, with double-extortion attacks growing by nearly 650 per cent when compared to 2021. This was followed by the restaurants and food services industry, which saw over a 450 per cent spike in ransomware.

As governments across the world have started to take ransomware seriously, many threat groups have disbanded and reformed under new names. For example, DarkSide rebranded as BlackMatter, DoppelPaymer rebranded as Grief, and Rook rebranded as Pandora. However, their threat has not diminished even as their tactics have changed. Instead, many are now offering their tools for sale on the dark web, increasing their scale through a ransomware-as-a-service business model.

Earlier this year, the United States issued a statement warning of the potential for malicious cyber conduct against the United States as a response to economic sanctions against Russia. The statement urged immediate action to harden cyber defences among both public and private sector organisations. Additional nations that are standing with Ukraine delivered similar warnings. To date, ThreatLabz has identified multiple attacks, such as the use of PartyTicket ransomware and the HermeticWiper malware against Ukraine, and attacks from the Conti threat group against multiple government entities. ThreatLabz is continuing to monitor for geopolitical attacks.

Desai added, “to minimise the chances of being breached and the damage that a successful ransomware attack can cause, organisations must use defence-in-depth strategies that include reducing the attack surface, adopting zero trust architecture that can enforce least-privilege access control, and continuously monitoring and inspecting data across all environments.”

How the Zscaler Zero Trust Exchange can prevent ransomware attacks

The Zscaler Zero Trust Exchange incorporates ransomware prevention controls into a holistic zero trust architecture that disrupts every stage of attacks and minimises damages. The following best practices and advanced capabilities can significantly reduce the risk of a ransomware attack.

• Preventing compromise with consistent security policies: With full SSL inspection at scale, browser isolation, inline sandboxing, and policy-driven access control to prevent access to malicious websites

• Eliminating lateral movement by removing applications from the internet and implementing a zero trust network access (ZTNA) architecture: By connecting users directly to apps, not the network, to limit the blast radius of an attack

• Shutting down compromised users and insider threats: By combining inline application inspection and integrated deception capabilities to detect and trick, and stop would-be at tackers

• Stopping data loss: By keeping software and training up-to-date, as well as deploying inline data loss prevention and inspecting data both in motion and at rest will prevent theft by threat actors