Geopolitical strife drives increased ransomware activity
Recorded ransomware attack volumes rose by 19% during October 2024 to a total of 468 incidents worldwide, a significant number of them in the US, where the controversial presidential election likely emboldened Russian-speaking threat actors to strike, according to NCC Groups latest monthly Threat pulse report.Although the full-scale of attempted Russian state interference in the US election process is not yet fully known, NCCs head of threat intelligence, Matt Hull, said it was little surprise the final few weeks before the 5 November poll saw ramping amounts of threat activity.Geopolitical motivations, like the US election, showed that nation states such as Russia continue to have heavy influence on global volumes of cyber attacks, he said.The data shows that we are witnessing changing dynamics of the threat landscape, with nation states and organised crime groups increasingly collaborating, said Hull. As different threat actors leverage each others resources, it is crucial for organisations to ensure that theyre on top of fundamental security practices such as password management, endpoint security and multi-factor authentication.Indeed, broken out by geography, the North America region which also includes countries like Canada and Mexico accounted for 272, or 56%, of the recorded ransomware attacks. In comparison, 97 attacks, 20%, victimised organisations in Europe, so all in all, over three-quarters of all ransomware attacks seen last month targeted these two regions.Of course, this is not to exclude the rest of the world, and one attack in particular aptly demonstrated the apparent blurring of the lines between nation states and organised criminals. This was an incident in which systems at Japanese electronics giant Casio were crippled by Underground ransomware, which is linked to Russian cyber crime group Storm-0978, or RomCom.The double extortion attack targeted employee, job candidate and business partner data, and caused outages and service disruptions. It likely began via CVE-2023-36884, a remote code execution vuln in Microsoft Office which is known to have been targeted by Russian state actors; and according to NCC, RomCom is thought to be one of a number of gangs that conduct attacks on behalf of the Kremlin.Read more about ransomwareWe look at ransomware attacks, and the importance of good backup practice as well as immutable snapshots, air-gapping, network segmentation,AI anomaly detection and supplier warranties.Anomaly detection and immutable copies can be frontline tools against ransomware we look at the role storage can play against the latest techniquesemployed by ransomware gangs.Threat intel specialists at Recorded Future have shared details of newly developed techniques they are using to disrupt Rhysida ransomware attacks before the gangeven has a chance to execute them.NCC said that growing geopolitical tension between Russia and Japan added a compelling layer to the incident. Russia, which has held the island of Sakhalin part of the ancestral homeland of Japans indigenous Ainu people and the nearby Kuril Islands, since the end of the Second World War, is thought to be concerned by Japans increasing military collaboration with the Nato alliance, and Moscow protested a recent joint military exercise, Keen Sword 2024, between the US and Japan.These military activities and Japans bolstered defence posture may have contributed to a rise in aggressive tactics by Russian-affiliated cyber entities, wrote the reports authors.Attacks on Japanese companies could serve as a form of pressure or retaliation, signalling Russias discontent with Japans defence strategies. By targeting key Japanese enterprises, Russia, through affiliated cyber criminal groups, might aim to disrupt economic stability and project power without overt military confrontation.The situation shows the complexity of modern cyber warfare, where criminal enterprises and state-backed actors could pursue both financial and strategic objectives As such, businesses should encompass a variety of threats, traditional and state-backed, in their defence strategy.In terms of the most prolific ransomware operators, it was RansomHub that continued its dominance as the most active gang in October, taking responsibility for 68 attacks, although this was down a little on the previous month.The second-place spot was held by Play, which accounted for about 55 attacks; followed by Killsec, with between 30 and 40; Sarcoma, with about 30; and Meow, with about 25.The rest of the top 10 most active operations last month were Fog, Hunters, ElDorado, Medusa and BlackSuit.Across the board, the industrials sector, which includes operators of critical national infrastructure (CNI), remained the most targeted, accounting for 148, or 30%, of the observed attacks. The consumer discretionary sector (retail) followed, with 100 attacks; and the healthcare sector accounted for 55.As demonstrated through the focus on CNI, attacks are becoming less random and more targeted to organisations that will experience maximum impact, said Hull.Those who rely on up-time and hold large amounts of intellectual property or personally identifiable information are high-value targets.
English
Arabic
French
Spanish
Portuguese
Deutsch
Turkish
Dutch
Italiano
Russian
Portuguese (Brazil)
Greek