A new report from NCC Group plc shows ransomware attacks hit a record high in May, largely due to a significant resurgence in LockBit ransomware activities. According to the NCC Group 2024 Threat Intel report, global ransomware attacks increased by 32% month-over-month in May, reaching 470 incidents compared to 356 in April. This marks an 8% increase compared to May of last year.
The spike in attacks is primarily attributed to LockBit 3.0, the latest version of the notorious LockBit ransomware gang. After being dismantled by law enforcement in February, the group resurfaced just a week later, quickly becoming the most active ransomware group, responsible for 37% of all ransomware attacks in May. LockBit was implicated in 176 ransomware incidents during the month.
Other notable ransomeware players mentioned in the report for May included:
- Play ransomware group in second position with 32 attacks, for 7% of all attacks in the month
- RansomHub came in at third position with 22 attacks
- DAn0n, with 13 attacks. A newcomer to the field that uses a double-tap extortion method.
- Underground, which also uses double-tap extortion, was recorded to have undertaken 12 ransomware attacks during the month
- Arcus Media, with 11 attacks
The report noted that the majority (77%) of ransomware attacks in May targeted companies in North America and Europe, with a notable increase in attacks in South America, accounting for 8% of the total, a 60% rise from April.
By sector, industrial companies remained the most targeted, a trend ongoing since January 2021, with 143 attacks in May, up from 116 in April. The technology sector was the second most targeted, with 72 attacks, an increase from 49 the previous month.
Cigent CGO Brett Hansen had this to say:
“The only real way to end ransomware is to make it no longer profitable for the bad actors. Let me be clear, solutions already exist in the commercial sector to protect against these threats. In addition to instituting zero-trust access to your data, adding available real-time encryption can ensure that data is useless to the attacker, if they do get in. While you’re adding data protection, the use of invisible partitions can ensure your data is not accessed by intruders. Data at rest can also be data protected.”
What we see here is a game of “whack a mole”. Where law enforcement takes out LockBit only to have LockBit reappear in a new form. Like Mr. Hansen has said, this isn’t working. Thus organizations need to take security a lot more seriously and implant things that will make it way harder for threat actors to pwn them.
UPDATE: Rogier Fischer, CEO and Co-Founder, Hadrian add this comment:
“Ransomware groups like LockBit versions, and Conti before that, show how cybercriminal organizations evolve and change tracks, often rebranding or merging with other groups to stay operational despite law enforcement actions. The cybersecurity community have been dredging up evidence of their interconnectivity, as seen in the use of shared resources, such as Conti’s leaked source code being adopted by LockBit for its “LockBit Green” variant. Law enforcement actions, including arrests and website seizures, have disrupted these groups temporarily, but have not eliminated the threat entirely, as these groups quickly adapt and reconstitute their operations. What we need it continuous, coordinated international efforts to effectively combat the ever-evolving ransomware menace.”
Kaspersky Says It’s Not A National Security Threat To The US
Posted in Commentary with tags Kaspersky on June 24, 2024 by itnerdLast week the US banned Kaspersky saying that it’s a national security risk. At the time, I could not find a response from the Russian software company. But clearly I didn’t look hard enough because now I have. Here’s what they said in part:
Kaspersky is aware of the decision of the Department of the Treasury’s Office of Foreign Assets Control (OFAC) to place members of the company’s executive and senior leadership team on the sanctions list. The current step will not affect the company’s resilience as neither Kaspersky nor its subsidiary companies nor its CEO were designated by the OFAC.
We regard the move as unjustified and baseless, being a continuation of recent U.S. government decisions based on the present geopolitical climate and theoretical concerns, rather than on a comprehensive evaluation of the integrity of company’s products and operations. Neither Kaspersky nor its management team has any ties to any government, and we consider the allegations quoted by the OFAC as pure speculation, which lacks concrete evidence of a threat posed to U.S. national security. None of the listed members have any ties to the Russian military and intelligence authorities or have anything to do with the Russian government’s cyber intelligence objectives.
John Gunn, CEO, Token had this to say:
Banning the use of Kaspersky software is a prudent and informed action. Kaspersky’s majority owner and CEO is a Russian national who lives in Russia and is subject to the jurisdiction of the Russian government. People who don’t do what Putin wants have a bad habit of falling out of windows. The code for many mature security applications is so complex that finding a designed-in vulnerability would be very challenging, and a “clean” version today could be updated to a malicious version at any time. Operating on a promise of trust from a country that is attacking us constantly would be bad strategy.
Here’s the thing. If you can’t trust the tools that you use to defend yourself against attackers, you shouldn’t use them. Which is why this ban makes sense despite the fact that some will find this as an over reaction by the US government. Will this ban make you stop using Kaspersky products? Sound off in the comments with your thoughts.
Leave a comment »