Ransomware and Microsoft Exchange Server attacks are surging

Issue 2 2021 Information Security

Check Point Research (CPR) is observing global surges in ransomware attacks, alongside an increase in cyberattacks targeting vulnerabilities in Microsoft Exchange servers. The revelation comes at a time when CISA (the USA’s Cybersecurity and Infrastructure Security Agency) has raised alarm bells about ransomware attacks against Microsoft Exchange servers, in addition to other security researchers who have already detected at least two groups leveraging Microsoft Exchange vulnerabilities to infect victims with ransomware, the BlackKingdom ransomware group and another unknown group deploying a new malware strain called DearCry.

CPR has spotted the following trends and data around ransomware attacks based on organisations it tracks:

Since October 2020, there has been a 57% increase in the number of organisations affected by ransomware globally.

• Since the beginning of 2021, the number of organisations affected by ransomware has been growing at 9% month over month.

• In the past six months, there has been a general increase in the number of attacks involving human-operated ransomware, such as Maze and Ryuk.

• In total, 3868 organisations have been affected.

• The top three countries that saw the most ransomware attack attempts are USA (12%), Israel (8%) and India (7%).

• The top three industry sectors that saw the most ransomware attack attempts are government/military (18%), manufacturing (11%), and finance/banking (8%).

CPR also found the following trends and data around cyberattacks that have targeted Microsoft Exchange servers:

The number of attacks involving Exchange server vulnerabilities has tripled.

• Over 50 000 attack attempts have now been documented by CPR on Microsoft Exchange servers.

• The most targeted industries are government/military, manufacturing and then banking/finance.

• The most affected country is the United States (49% of all exploit attempts), followed by the United Kingdom (5%), the Netherlands (4%) and Germany (4%).

WannaCry trends, again

WannaCry is trending again. WannaCry is a ransomware worm that spread rapidly through a number of computer networks in May of 2017. After infecting a Windows computer, it encrypts files on the PC’s hard drive, making them impossible for users to access, then demands a ransom payment in bitcoin in order to decrypt them. CPR has spotted the following trends and data around WannaCry:

Since the beginning of the year, the number of organisations affected by WannaCry globally has increased by 53%.

• There are 40 times more affected organisations in March 2021 when compared to October 2020.

• The new samples still use the EternalBlue exploit to propagate.

Lotem Finkelsteen, Check Point's manager of threat intelligence, comments: “Two trends are happening concurrently. One, cyberattacks targeting Microsoft Exchange servers are increasing sharply. Two, ransomware attacks are simultaneously rising steadily. Although we have not concluded that the two trends are directly related just yet, there is reason for concern. We do believe the Microsoft Exchange vulnerabilities opened up another door into organisations. And so Check Point Research is also raising the alarm bells, just like CISA has. We’re urging organisations to act now, before ransomware gangs make Exchange exploits popular. In cybercrime, we rarely see businesses that demonstrate constant growth, or rapid adjustments to changing factors, as well as quick adoptions of new technologies. Ransomware is one of those rare businesses.”

How organisations can protect against ransomware

1. Back up all data – One of the most important tasks is backing up your company’s data. If something goes wrong, your data should be able to quickly and easily revert to a previous version.

2. Keep software updated – Ransomware attackers sometimes find an entry point within apps and software, noting vulnerabilities and capitalising on them. Fortunately, some developers actively search for new vulnerabilities and patch them.

3. Use better threat detection – Most ransomware attacks can be detected and resolved before it’s too late. To maximise your chances of protection, have automated threat detection in place in your organisation.

4. Adopt multifactor authentication – Multifactor authentication forces users to verify their identities in multiple ways before they’re granted access to a system. This way, if an employee mistakenly gives their password to a cybercriminal, the criminal won’t be able to gain easy access to your systems.

5. Scan and monitor emails and file activity – Emails are a common choice for cybercriminals executing phishing schemes, so take the time to scan and monitor emails on an ongoing basis, and consider deploying an automated email security solution to block malicious emails from ever reaching users.

Find out more at www.checkpoint.com




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Stronger cloud protection
Information Security Products & Solutions
Kaspersky has announced the release of an enhanced version of its Kaspersky Cloud Workload Security, delivering advanced protection for hybrid and multi-cloud environments.

Read more...
AttackIQ enters South Africa with key appointment
Information Security News & Events
AttackIQ, a provider of continuous security validation and exposure management, has announced its entry into the South African market with the appointment of Luke Cifarelli as its country manager.

Read more...
Managed security solutions for organisations of all sizes
Information Security News & Events
Cyber attackers have become significantly more sophisticated and determined, targeting businesses of all sizes. PwC’s Global Digital Trust Insights Survey 2025 Africa and South Africa highlights the urgent need for organisations to implement robust cyber risk mitigation strategies.

Read more...
Data resilience at VeeamON
Infrastructure Information Security
SMART Security Solutions attended the VeeamON Tour in Johannesburg in August to learn more about data resilience and Veeam’s initiatives to enhance data protection, both on-site and in the cloud.

Read more...
Troye exposes the Entra ID backup blind spot
Information Security Infrastructure
If you trust Microsoft to protect your identity, think again. Many organisations naively believe that Microsoft’s shared responsibility model covers Microsoft Entra?ID – formerly Azure AD – but it does not.

Read more...
Secure data protection without hardware lock-in
Infrastructure Information Security News & Events
New Veeam Software Appliance empowers IT teams to achieve instant protection with Veeam’s fully preconfigured, software-only appliance, delivering enterprise-ready simplified deployment and operational efficiency, robust cyber resilience.

Read more...
Check Point launches open, vendor-neutral MDR services
Information Security News & Events Products & Solutions
New Check Point MDR 360° and MXDR 360° offerings deliver 24/7 managed continuous threat monitoring protection across endpoints, cloud and network environments with built-in identity threat detection and 160+ integrations across hybrid, multi-vendor environments.

Read more...
Credential theft surges in South Africa
Information Security
NEC XON issues a critical cybersecurity warning about the dual threat of massive credential theft and AI-powered cyberattacks sweeping across the region, with an increasing number of incidents and evolving threat tactics.

Read more...
Want effective Attack Surface Management? Think like an attacker.
Information Security
Effective ASM requires companies to think like attackers, anticipate risks, and act decisively to reduce exposure by knowing their environment, deploying a structured approach, leveraging capable tools, and addressing both internal and external risks.

Read more...
The growing role of hybrid backup
Infrastructure Information Security
As Africa’s digital economy rapidly grows, businesses across the continent are facing the challenge of securing data in an environment characterised by evolving cyberthreats, unreliable connectivity and diverse regulatory frameworks.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.