Hackers adopting aggressive ransomware tactics

Ransomware groups are using their best of breed tactics to go for newer attacks, as the involvement of law enforcement in these incidents forced many to exit the playing field. A report from ESET says in its threat report, intensifying brute-force attacks, and deceptive phishing campaigns targeting people working from home who have gotten used to performing many administrative tasks remotely. Ransomware, showing three major detection spikes during the second quarter, saw the highest ransom demands to date.

The attack collapsed the operations of a colonial pipeline - the largest US pipeline company - and the supply-chain attack leveraging a vulnerability in the Kaseya VSA IT management software, sent shockwaves far beyond the cybersecurity industry. The offender of the Kaseya attack had asked for $70 million - the highest known ransom demand so far. Ransomware gangs may have overdone it this time: the involvement of law enforcement in these high-impact incidents forced several gangs to leave the field. The same can’t be said for TrickBot, which appears to have bounced back from last year’s disruption efforts.

ESET detected 55 million new brute-force attacks (+ 104% compared to T1 2021 ) against public-facing remote desktop protocol services during May and August 2021. ESET telemetry also witnessed an impressive increase in the average number of daily attacks per unique client, which doubled from 1,392 attempts per machine per day in T1 2021 to 2,756 in T2 2021.

The Threat Report includes the findings of the highly targeted DevilsTongue spyware, which is used to spy on human rights defenders, dissidents, journalists, activists, and politicians; and a new spear-phishing campaign by the Dukes APT group, which remains a prime threat to Western diplomats, NGOs, and think tanks.