Most Ransomware Infections are Self-installed
New research from managed detection and response (MDR) provider Expel found that most ransomware attacks in 2021 were self-installed.
The finding was included in the company’s inaugural annual report on cybersecurity trends and predictions, Great eXpeltations, published on Thursday.
Researchers found eight out of ten ransomware infections occurred after victims unwittingly opened a zipped file containing malicious code. Abuse of third-party access accounted for 3% of all ransomware incidents, and 4% were caused by exploiting a software vulnerability on the perimeter.
The report was based on the analysis of data aggregated from Expel’s security operations center (SOC) concerning incidents spanning January 1 2021 to December 31 2021.
Other key findings were that 50% of incidents were BEC (business email compromise) attempts, with SaaS apps a top target.
More than 90% of those attacks were geared towards Microsoft O365, while assaults against Google Workspace accounted for fewer than 1% of incidents. The remaining 9% targeted Okta.
Ransomware attacks accounted for 13% of all opportunistic attacks. The five most targeted industries in descending order were legal services, communications, financial services, real estate and entertainment.
In addition, 35% of web app compromises Expel responded to resulted in the deployment of a crypto miner.
To protect against threats in 2022, Expel recommended implementing network layer controls to detect and block network communications to crypto mining pools and confirming event data recorder (EDR) coverage across all endpoints.
The company also advised forwarding computing resource alarms to a security information and event management (SIEM) software solution to flag overtaxed resources potentially deployed for crypto-jacking.
Other advice included defending the self-installation attack surface on Windows, deploying MFA everywhere, especially for remote access, patching and updating regularly and deploying EDR policies in block mode.
Users were also advised not to expose RDP (remote desktop protocol) directly to the internet.
“We founded Expel with a goal of bringing more transparency to security,” said Dave Merkel, CEO of Expel, on Thursday.
“Today we reach a new milestone tied to that commitment – we’re sharing the most important threats and trends our SOC identified last year and their advice on what to do about them.”
More Stories
ForgeRock, Double Secret Octopus offer passwordless authentication for enterprises
ForegeRock is adding a new passwordless authentication capability, called Enterprise Connect Passwordless, to its flagship Identity Platform product to help...
ForgeRock, Secret Double Octopus offer passwordless authentication for enterprises
ForegeRock is adding a new passwordless authentication capability, called Enterprise Connect Passwordless, to its flagship Identity Platform product to help...
Mispadu Trojan Steals 90,000+ Banking Credentials From Latin American Victims
These included a number of government websites: 105 in Chile, 431 in Mexico and 265 in Peru Read More
KillNet Group Uses DDoS Attacks Against Azure-Based Healthcare Apps
Microsoft said it saw between 40 and 60 daily attacks in February Read More
BreachForums Admin Arrested in New York
Conor Brian Fitzpatrick of Peekskill was apprehended last Wednesday following an FBI investigation Read More
CISA kicks off ransomware vulnerability pilot to help spot ransomware-exploitable flaws
Last week, the US Cybersecurity and Infrastructure Security Agency (CISA) announced the launch of the Ransomware Vulnerability Warning Pilot (RVWP)...