Ransomware and Microsoft Exchange Server attacks are surging

Issue 2 2021 Cyber Security

Check Point Research (CPR) is observing global surges in ransomware attacks, alongside an increase in cyberattacks targeting vulnerabilities in Microsoft Exchange servers. The revelation comes at a time when CISA (the USA’s Cybersecurity and Infrastructure Security Agency) has raised alarm bells about ransomware attacks against Microsoft Exchange servers, in addition to other security researchers who have already detected at least two groups leveraging Microsoft Exchange vulnerabilities to infect victims with ransomware, the BlackKingdom ransomware group and another unknown group deploying a new malware strain called DearCry.

CPR has spotted the following trends and data around ransomware attacks based on organisations it tracks:

Since October 2020, there has been a 57% increase in the number of organisations affected by ransomware globally.

• Since the beginning of 2021, the number of organisations affected by ransomware has been growing at 9% month over month.

• In the past six months, there has been a general increase in the number of attacks involving human-operated ransomware, such as Maze and Ryuk.

• In total, 3868 organisations have been affected.

• The top three countries that saw the most ransomware attack attempts are USA (12%), Israel (8%) and India (7%).

• The top three industry sectors that saw the most ransomware attack attempts are government/military (18%), manufacturing (11%), and finance/banking (8%).

CPR also found the following trends and data around cyberattacks that have targeted Microsoft Exchange servers:

The number of attacks involving Exchange server vulnerabilities has tripled.

• Over 50 000 attack attempts have now been documented by CPR on Microsoft Exchange servers.

• The most targeted industries are government/military, manufacturing and then banking/finance.

• The most affected country is the United States (49% of all exploit attempts), followed by the United Kingdom (5%), the Netherlands (4%) and Germany (4%).

WannaCry trends, again

WannaCry is trending again. WannaCry is a ransomware worm that spread rapidly through a number of computer networks in May of 2017. After infecting a Windows computer, it encrypts files on the PC’s hard drive, making them impossible for users to access, then demands a ransom payment in bitcoin in order to decrypt them. CPR has spotted the following trends and data around WannaCry:

Since the beginning of the year, the number of organisations affected by WannaCry globally has increased by 53%.

• There are 40 times more affected organisations in March 2021 when compared to October 2020.

• The new samples still use the EternalBlue exploit to propagate.

Lotem Finkelsteen, Check Point's manager of threat intelligence, comments: “Two trends are happening concurrently. One, cyberattacks targeting Microsoft Exchange servers are increasing sharply. Two, ransomware attacks are simultaneously rising steadily. Although we have not concluded that the two trends are directly related just yet, there is reason for concern. We do believe the Microsoft Exchange vulnerabilities opened up another door into organisations. And so Check Point Research is also raising the alarm bells, just like CISA has. We’re urging organisations to act now, before ransomware gangs make Exchange exploits popular. In cybercrime, we rarely see businesses that demonstrate constant growth, or rapid adjustments to changing factors, as well as quick adoptions of new technologies. Ransomware is one of those rare businesses.”

How organisations can protect against ransomware

1. Back up all data – One of the most important tasks is backing up your company’s data. If something goes wrong, your data should be able to quickly and easily revert to a previous version.

2. Keep software updated – Ransomware attackers sometimes find an entry point within apps and software, noting vulnerabilities and capitalising on them. Fortunately, some developers actively search for new vulnerabilities and patch them.

3. Use better threat detection – Most ransomware attacks can be detected and resolved before it’s too late. To maximise your chances of protection, have automated threat detection in place in your organisation.

4. Adopt multifactor authentication – Multifactor authentication forces users to verify their identities in multiple ways before they’re granted access to a system. This way, if an employee mistakenly gives their password to a cybercriminal, the criminal won’t be able to gain easy access to your systems.

5. Scan and monitor emails and file activity – Emails are a common choice for cybercriminals executing phishing schemes, so take the time to scan and monitor emails on an ongoing basis, and consider deploying an automated email security solution to block malicious emails from ever reaching users.

Find out more at www.checkpoint.com

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Cyber resilience is more than cybersecurity
Technews Publishing Cyber Security Integrated Solutions IT infrastructure
Hi-Tech Security Solutions held a round-table discussion focusing on cyber resilience and found that while the resilience discipline includes cybersecurity, it also goes much further.

Defining the resilience of cybersecurity
Cyber Security Security Services & Risk Management
Cyber resilience is less buzzword and more critical business strategy as the cybercrime landscape grows in intent and intensity.

How to stay cybersafe on business trips
Cyber Security
No matter where you are in the world, tech-savvy criminals are looking for ways to exploit email addresses, social media profiles, passwords, financial data and stored files.

The challenge of data safety and availability
Technews Publishing Editor's Choice Cyber Security
Veeam offers backup and recovery software that presents the user with one interface to manage backups to and from almost any platform.

How safe are your backups?
Technews Publishing Cyber Security
Immutable backups prevent malware from compromising your data and ensure the right data is restored in an emergency when following a four-step backup process.

Growing cyber resilience portfolio
Technews Publishing Cyber Security
Hi-Tech Security Solutions spoke to Richard Frost, who heads up Armata, to find out what the company offers in terms of cyber resilience.

Adopting a cyber-secure mindset
Security Services & Risk Management Cyber Security
Adopting a cybersecure mindset is the key to mitigating the risk of falling victim to the growing cybercrime pandemic.

Advanced technologies to curb corruption
News Cyber Security IT infrastructure
The use of advanced technology to curb fraud, corruption and cyber-related crimes received a massive boost as the Council for Scientific and Industrial Research (CSIR) and Special Investigation Unit (SIU) agreed to work together.

Reversing the hidden risk of permission creep
Cyber Security
Employees can collect a range of access rights to business systems throughout their tenure. It's a phenomenon called 'permission creep': one of the biggest cybersecurity risks for organisations today.

Mitigating the risk of zero-day attacks against Microsoft 365
J2 Software Cyber Security
Microsoft 365 servers contain extremely sensitive information and most organisations simply cannot do without it for an extended period of time.