Ransomware Report October 2023 An In-Depth Analysis of the Latest Ransomware Trends and Threat Landscape
Dive into the constantly shifting world of ransomware, as we uncover the latest tactics, dissect the most prolific actors, and offer insights to keep your organization one step ahead.
Lockbit remains the leader, while some other strong players have slowed down this month. An interesting development is the announcement of Boeing as a ransomware victim. It is unusual for Lockbit to target a large organization like Boeing. It is possible that a rogue affiliate conducted the hack, and Lockbit played along.
RansomedVC has been put up for sale by a group of forum admins who founded it. They made some bold claims, such as hacking Sony, but were unable to manage the operations. They also claimed to have information about 120 companies that they never announced. It is likely that this information was obtained through a third party and may not be as sensitive as they claimed. It could be just a sales tactic.
RANSOMWARE THREAT ANALYSIS
Geographic Hotspots of Ransomware
Ransomware attacks are a global epidemic, but they disproportionately affect certain regions. The United States consistently tops the chart with the highest number of ransomware victims.
Following the US, UK and Italy are next on the list this month. Wealthy countries are generally favored targets due to their lucrative digital environments. Despite their wealth, some nations see fewer tracks, due to a sense of nationalism from the cybercriminal groups. This suggests the motivations of criminals vary from group to group, with some seeking financial gain and others making political statements.
Ransomware Perpetrators Unmasked
Our data showcases a diverse range of ransomware groups, each with their own unique tactics, techniques, and procedures.
The top three dominating the landscape are Lockbit 3.0, Play, and Noescape. Each of these groups has a distinct modus operandi and target preference, painting a picture of a highly specialized and segmented market.
It’s important to remember, however, that while these groups grab the headlines, countless other smaller, yet equally dangerous groups are operating under the radar. By understanding the tactics of these leading groups, organizations can better anticipate potential threats and adapt their defenses accordingly.
Industry Breakdown
Not all industries are targeted equally by ransomware groups. Our data shows that Manufacturing, Professional, Scientific and Technical Services, and Healthcare and Social Assistance bear the brunt of these attacks. The high value of data and often weaker cybersecurity defenses make these sectors particularly attractive targets. However, no industry is immune, and the ever-evolving nature of ransomware means that staying ahead of the curve is vital for all sectors. By understanding which industries are most targeted, we can infer the sectors that ransomware groups perceive as the most vulnerable or lucrative, helping to direct focus and resources in the ongoing fight against this cyber menace.
Geographical Preferences of Ransomware Groups
Each ransomware group has a unique footprint in terms of their geographical targets. The data shows that groups like Lockbit 3.0, Play, and Noescape predominantly target specific regions.
Understanding these patterns can help nations and organizations to better anticipate and prepare for potential threats.
However, it’s critical to remember that cybercrime knows no borders, and organizations in all countries should remain vigilant against these rapidly evolving threats. The diversity in targeting underscores the global nature of the ransomware problem and the need for international cooperation in addressing it.
Ransomware Strikes: Industry-wide
Each ransomware group has a unique pattern of target selection, but some industries find themselves more frequently caught in the crosshairs. Based on our data, Manufacturing, Professional, Scientific and Technical Services, and Healthcare and Social Assistance often emerge as primary targets for ransomware attacks. For instance, one particular ransomware group, Lockbit 3.0, shows a discernible preference for Manufacturing. It’s critical for these industries to understand and anticipate these patterns, preparing robust defenses against potential threats. Remember, forewarned is indeed forearmed.
Spotlight on Ransomware Indicators
Leveraging the data-rich platform of Black Kite, we analyze ransomware indicators to identify common vulnerabilities that ransomware groups exploit. These indicators, including IP addresses, domains, or hashes, have been associated with our list of victims this month.
By shedding light on MX and DNS misconfiguration, Use of out-of-date services/products, and Open RDP or SMB ports publicly visible, we highlight the cyber vulnerabilities ransomware groups actively exploit. Recognizing these indicators and taking prompt preventive measures can significantly strengthen an organization’s defenses against ransomware attacks.
0
At least one IP address that was part of a botnet, malware propagation, or spam propagation
0
Use of out-of-date services/products with possible vulnerabilities of high exploitability
0
At least one possible phishing domain
0
Open RDP or SMB ports publicly visible
0
At least one credential leaked in the last 90 days
0
MX and DNS misconfiguration that may allow spoofing and phishing attacks
RSI Breakdown for IT Industry
The Ransomware Susceptibility Index (RSI) quantifies a company’s likelihood of falling victim to a ransomware attack. In this month’s spotlight, the Education industry takes center stage as we dissect the RSI distribution of thousands of companies within this sector.
As seen from the data, a considerable portion, 36% to be precise, of the analyzed Education companies have an RSI of 0.4 or higher. This figure is critical as companies with an RSI of 0.4 and above are at a significantly high risk of ransomware attacks. These findings underscore the need for Education companies to implement robust cybersecurity measures and proactively manage their ransomware risk, thereby contributing to a healthier cybersecurity posture within the industry.
Industry-wide RSI Breakdown
In our continuous monitoring of hundreds of thousands of companies, we’ve computed the average RSI (Ransomware Susceptibility Index values for each industry. These values paint a comprehensive picture of the industry-specific cyber risks that organizations face. In this month’s analysis, Education, Nuclear reactors, materials and waste, and Chemical Industries show the highest average RSI values. The data suggests that these industries may have heightened exposure to ransomware threats and need to be especially proactive in bolstering their cybersecurity defenses.
Share the report data