New research from Trend Micro Incorporated warns of spiraling risk to digital infrastructure and remote workers as threat actors increase their rate of attack on organizations and individuals.
Ransomware attackers are shifting their focus to critical businesses and industries more likely to pay, and double extortion tactics ensure that they are able to profit. Ransomware-as-a-service offerings have opened the market to attackers with limited technical knowledge – but also given rise to more specialization, such as initial access brokers who are now an essential part of the cybercrime supply chain.
Threat actors are also getting better at exploiting human error to compromise cloud infrastructure and remote workers. Trend Micro Cloud App Security (CAS) detected and prevented 25.7 million email threats in 2021 compared to 16.7 million in 2020, with the volume of blocked phishing attempts nearly doubling over the period. Research shows home workers are often prone to take more risks than those in the office, which makes phishing a particular risk.
In the cloud, incorrectly configured systems continue to plague organizations. Services such as Amazon Elastic Block Store and Microsoft Azure’s Virtual Machine were among the services that had relatively high misconfiguration rates. Trend Micro also found that Docker REST APIs are frequently misconfigured, exposing them to attacks from groups like TeamTNT that deploy crypto-mining malware on affected systems.
Business email compromise (BEC) saw detections drop 11%. However, CAS blocked a higher percentage of advanced BEC emails, which could be detected only by comparing the writing style of the attacker with that of the intended sender. These attacks comprised 47% of all BEC attempts in 2021 versus 23% in 2020.
While 2021 was a record year for new vulnerabilities, Trend Micro research shows that 22% of the exploits sold in the cybercrime underground last year were over three years old. Patching old vulnerabilities remains an essential task alongside monitoring for new threats to prevent cyber-attacks and ensure strong security posture.
To learn more about Navigating New Frontiers: Trend Micro 2021 Annual Cybersecurity Report, please visit: https://www.trendmicro.com/vinfo/us/security/research-and-analysis/threat-reports/roundup/navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report
LokiLocker Ransomware Packs Data Wiping Capabilities
Posted in Commentary with tags BlackBerry, Security on March 18, 2022 by itnerdBlackBerry has warned of a new ransomware family identified as LokiLocker. The RaaS family targets Windows systems by threatening to overwrite a victims Windows Master Boot Record (MBR), which in turn wipes all files and renders the machine completely unusable. However, when that tactic is taken into play, it negates all conversations of payments. BlackBerry has pointed to some evidence that suggests LokiLocker was developed by Iranian hackers and designed to target English-speaking victims.
Aimei Wei, CTO and Founder, Stellar Cyber had this to say:
“The research shows that Ransomware is happening at scale. It is provided as a service to many affiliates. It is also becoming more destructive. Besides encrypting files, it also wipes the system. The chance of being hit has greatly increased and consequence is bigger. People should always have data backup, preferably offline, and exercising caution when downloading files or opening attachments. In addition, for organizations, deploying a threat detection and response system or using a threat detection/response service may help to quickly discover the attack, disrupt/stop it from spreading and reduce the damage.”
This is important to item to note:
At the time of writing this, there is no free tool to decrypt files encrypted by LokiLocker. If you are already infected with LokiLocker ransomware, the recommendation by most official security authorities – such as the FBI – is not to pay the ransom. Quite apart from the fact that every victim who pays the ransom perpetuates the global growth of ransomware, remember that you’re dealing with criminals here, and there is no guarantee that you’ll regain access to your data, even if you pay up. Finally, even if you’re data is restored, there is no way to know whether the threat actor planted a backdoor somewhere on your machine, for easy future access. After all, people who pay one ransom can often be persuaded to pay another.
When it comes to ransomware of all types, often the best thing we can do as defenders is to make every effort to stay one step ahead of the threat actors, even when the journey proves complex and arduous.
With that in mind. Prevention is the key to not getting pwned by this. Thus companies need to do whatever is required to ensue that they don’t become victims of this ransomware.
Leave a comment »