Ransomware

Increased ransomware incidents in 2024 – Checkpoint Report

The annual Ransomware report for 2024 from the research team of Checkpoint reveals a deep change in cyber threats, with ransomware incidents facing an increase of 11% in 2024 in comparison to 2023.

In particular, Q4’s attacks represented the 33% of all the attacks, making it the most active semester recorded, with a total of 1.827 incidents.

Key findings of the report are outlined below:

• General increase: the report records in total 5.414 ransomware attacks in 2024, with an increase of 11% when compared to 2023. The most active period was the fourth semester, with 1.827 incidents which represent the 33% of the annual total.

  Continue reading

Amateur criminals pose a significant threat to cyberspace

Amateur criminals who use do-it-yourself solutions to increase their attacks are now an increasing threat for the internet users. Kaspersky’s GReAT (Global Research & Analysis Team) published a report that describes the recent ransomware attacks with the use of code. The report sheds a light on the tools and the methods that are used by organized ransomware groups and single users. According to its findings the ransomware criminal organisations have a vast variety of tools and samples at their disposal. They often own sample ransomware, while isolated users often use DIY leaked variations to launch their attacks. The study by Kasperksy reveals recent ransomware attacks, which take advantage of the source code leaks, by allowing the attackers to locate their victims and reproduce fast any malware activity, thus constituting them a significant threat. Last April, the SEXi team attacked IxMetro, by using a recent ransomware variation called SEXi. This group targets ESXi apps while all the recognized victims used versions of the apps that were not supported. SEXi uses different ransomware versions for every platform – Bakuk for Linus and Lockbit for Windows. They are, also, the only ones using this Session app for communication, with a unified ID for multiple attacks. This lack of professionalism and the absence of a TOR leak website made them stand out even more.

Continue reading

How Local and Regional Authorities can improve their ransomware defenses

A recent study done by the National Association of State CIOs (NASCiO) and Deloitte found in the US 75% of state CISOs view ransomware as a threat. As this Govloop report reported “…there’s good reason for that. A number of factos, the report notes that combine to make local and regional governments particularly vulnerable to this attack”.

• High impact: Ransomeware is capable of causing an organization’s operations to a halt. As an attack it is one of the most likely facing local and regional organizations.
• Easy entry: With commercialization of attacks using “Ransomware-as-a-Service”, even non-technical threat actors are able to profit easily from ransomware operations
• Emergence of distributors: Malware families tend to be, the Govloop article points out, prolific information stealers are linked to various ransomware operators.

Clearly local and regional organizations need to revamp their strategies to deal with these challenges:

Continue reading

A great base scenario for CS-AWARE-NEXT?

Don’t remember if have heard of this incident before, but this could actually be a great base scenario for CS-AWARE-NEXT. It is about the May 2021 ransomware attack on the Health Service Executive (HSE).

At the end of the year 2021, a report was published, that had been commissioned by the Health Services Executive (“HSE”). The report counts about 100 pages – so it is not what one might regard as a convenient reading for an evening discussion. However, there are many generic cybersecurity issues that the report raises that are to be addressed in the CS-AWARE-NEXT project

Continue reading

Another attack…

Last week, another attack against the UK’s National Health Service: this time the target was the NHS 111, a hot line helps people get the right advice and treatment when they urgently need it. So it is not about cinema ticket reservations or something else that one would consider as less important, less critical or less urgent.

You can read about this here and here. So it is nothing new at all – same attacks took place last May in Carinthia in Austria. You can also read about this here as well.

Continue reading