Experts Reveals 29% Surge in Bugs Used by Ransomware Actors
There’s been a 29% increase in the number of vulnerabilities exploited by ransomware groups to compromise their targets over the past year, according to a new industry report.
The Ransomware Spotlight Year End Report was written by security vendors Ivanti and Cyware alongside CVE numbering authority Cyber Security Works. It’s compiled from multiple data sources, including Ivanti and CSW, publicly available threat databases and threat researchers and pen-testing teams.
The analysis revealed 65 new bugs associated with ransomware in 2021, totaling 288. Over a third (37%) of the newly added vulnerabilities were found trending on dark websites and subject to repeated exploitation as a result. Plus, over half (56%) of the older CVEs are still being regularly exploited, it said.
The report also highlighted that many zero-day vulnerabilities are being exploited before they’ve even had time to be published in the US National Vulnerability Database (NVD). These include ones used to compromise Kaseya (CVE-2021-30116) and the infamous Log4Shell bug (CVE-2021-44228).
The ransomware-as-a-service (RaaS) model is helping to democratize this kind of activity across the cybercrime underground. Particularly dangerous are exploit-as-a-service offerings, which allow threat actors to rent zero-day exploits from developers, the report said.
Despite recent arrests in Russia, many of these cybercrime gangs continue to be sheltered by hostile states.
Illustrating just how thriving the industry still is, the report identified 32 new ransomware variants in 2021, a 26% year-on-year increase, which brings the total to 157.
“Ransomware groups are becoming more sophisticated, and their attacks more impactful. These threat actors are increasingly leveraging automated tool kits to exploit vulnerabilities and penetrate deeper into compromised networks. They are also expanding their targets and waging more attacks on critical sectors, disrupting daily lives and causing unprecedented damage,” argued Ivanti SVP of security products, Srinivas Mukkamala.
“Organizations need to be extra vigilant and patch weaponized vulnerabilities without delays. This requires leveraging a combination of risk-based vulnerability prioritization and automated patch intelligence to identify and prioritize vulnerability weaknesses and then accelerate remediation.”
However, vulnerabilities are still not the number one threat vector for ransomware, according to Coveware.
As of Q3 2021, RDP compromise stemming from misconfiguration, and email phishing, remained the main ways to penetrate victim networks, the vendor claimed.
However, it added that vulnerability exploits were gaining popularity as an initial threat vector “as common peripheral applications get targeted, and patching cadence by enterprises lags.”
Experts Reveals 29% Surge in Bugs Used by Ransomware Actors
There’s been a 29% increase in the number of vulnerabilities exploited by ransomware groups to compromise their targets over the past year, according to a new industry report.
The Ransomware Spotlight Year End Report was written by security vendors Ivanti and Cyware alongside CVE numbering authority Cyber Security Works. It’s compiled from multiple data sources, including Ivanti and CSW, publicly available threat databases and threat researchers and pen-testing teams.
The analysis revealed 65 new bugs associated with ransomware in 2021, totaling 288. Over a third (37%) of the newly added vulnerabilities were found trending on dark websites and subject to repeated exploitation as a result. Plus, over half (56%) of the older CVEs are still being regularly exploited, it said.
The report also highlighted that many zero-day vulnerabilities are being exploited before they’ve even had time to be published in the US National Vulnerability Database (NVD). These include ones used to compromise Kaseya (CVE-2021-30116) and the infamous Log4Shell bug (CVE-2021-44228).
The ransomware-as-a-service (RaaS) model is helping to democratize this kind of activity across the cybercrime underground. Particularly dangerous are exploit-as-a-service offerings, which allow threat actors to rent zero-day exploits from developers, the report said.
Despite recent arrests in Russia, many of these cybercrime gangs continue to be sheltered by hostile states.
Illustrating just how thriving the industry still is, the report identified 32 new ransomware variants in 2021, a 26% year-on-year increase, which brings the total to 157.
“Ransomware groups are becoming more sophisticated, and their attacks more impactful. These threat actors are increasingly leveraging automated tool kits to exploit vulnerabilities and penetrate deeper into compromised networks. They are also expanding their targets and waging more attacks on critical sectors, disrupting daily lives and causing unprecedented damage,” argued Ivanti SVP of security products, Srinivas Mukkamala.
“Organizations need to be extra vigilant and patch weaponized vulnerabilities without delays. This requires leveraging a combination of risk-based vulnerability prioritization and automated patch intelligence to identify and prioritize vulnerability weaknesses and then accelerate remediation.”
However, vulnerabilities are still not the number one threat vector for ransomware, according to Coveware.
As of Q3 2021, RDP compromise stemming from misconfiguration, and email phishing, remained the main ways to penetrate victim networks, the vendor claimed.
However, it added that vulnerability exploits were gaining popularity as an initial threat vector “as common peripheral applications get targeted, and patching cadence by enterprises lags.”
More Stories
UK police reveal they are running fake DDoS-for-hire sites to collect details on cybercriminals
There's bad news if you're someone who is keen to launch a Distributed Denial-of-Service (DDoS) attack to boot a website...
Microsoft Fixes Security Flaw in Windows Screenshot Tools
Information disclosure vulnerability aCropalypse could enable malicious actors to recover sections of screenshots Read More
Three Variants of IcedID Malware Discovered
The new variants hint that considerable effort is going into the future of IcedID and its codebase Read More
New MacStealer Targets Catalina, Newer MacOS Versions
The malware can extract information from documents, browser cookies and login information Read More
Can zero trust be saved?
Graham Cluley Security News is sponsored this week by the folks at Kolide. Thanks to the great team there for...
Part of Twitter source code leaked on GitHub
Part of Twitter’s source code has been leaked and posted on GitHub by an unknown user. GitHub took down the...