Ransomware and Microsoft Exchange Server attacks are surging

Issue 2 2021 Cyber Security

Check Point Research (CPR) is observing global surges in ransomware attacks, alongside an increase in cyberattacks targeting vulnerabilities in Microsoft Exchange servers. The revelation comes at a time when CISA (the USA’s Cybersecurity and Infrastructure Security Agency) has raised alarm bells about ransomware attacks against Microsoft Exchange servers, in addition to other security researchers who have already detected at least two groups leveraging Microsoft Exchange vulnerabilities to infect victims with ransomware, the BlackKingdom ransomware group and another unknown group deploying a new malware strain called DearCry.

CPR has spotted the following trends and data around ransomware attacks based on organisations it tracks:

Since October 2020, there has been a 57% increase in the number of organisations affected by ransomware globally.

• Since the beginning of 2021, the number of organisations affected by ransomware has been growing at 9% month over month.

• In the past six months, there has been a general increase in the number of attacks involving human-operated ransomware, such as Maze and Ryuk.

• In total, 3868 organisations have been affected.

• The top three countries that saw the most ransomware attack attempts are USA (12%), Israel (8%) and India (7%).

• The top three industry sectors that saw the most ransomware attack attempts are government/military (18%), manufacturing (11%), and finance/banking (8%).

CPR also found the following trends and data around cyberattacks that have targeted Microsoft Exchange servers:

The number of attacks involving Exchange server vulnerabilities has tripled.

• Over 50 000 attack attempts have now been documented by CPR on Microsoft Exchange servers.

• The most targeted industries are government/military, manufacturing and then banking/finance.

• The most affected country is the United States (49% of all exploit attempts), followed by the United Kingdom (5%), the Netherlands (4%) and Germany (4%).

WannaCry trends, again

WannaCry is trending again. WannaCry is a ransomware worm that spread rapidly through a number of computer networks in May of 2017. After infecting a Windows computer, it encrypts files on the PC’s hard drive, making them impossible for users to access, then demands a ransom payment in bitcoin in order to decrypt them. CPR has spotted the following trends and data around WannaCry:

Since the beginning of the year, the number of organisations affected by WannaCry globally has increased by 53%.

• There are 40 times more affected organisations in March 2021 when compared to October 2020.

• The new samples still use the EternalBlue exploit to propagate.

Lotem Finkelsteen, Check Point's manager of threat intelligence, comments: “Two trends are happening concurrently. One, cyberattacks targeting Microsoft Exchange servers are increasing sharply. Two, ransomware attacks are simultaneously rising steadily. Although we have not concluded that the two trends are directly related just yet, there is reason for concern. We do believe the Microsoft Exchange vulnerabilities opened up another door into organisations. And so Check Point Research is also raising the alarm bells, just like CISA has. We’re urging organisations to act now, before ransomware gangs make Exchange exploits popular. In cybercrime, we rarely see businesses that demonstrate constant growth, or rapid adjustments to changing factors, as well as quick adoptions of new technologies. Ransomware is one of those rare businesses.”

How organisations can protect against ransomware

1. Back up all data – One of the most important tasks is backing up your company’s data. If something goes wrong, your data should be able to quickly and easily revert to a previous version.

2. Keep software updated – Ransomware attackers sometimes find an entry point within apps and software, noting vulnerabilities and capitalising on them. Fortunately, some developers actively search for new vulnerabilities and patch them.

3. Use better threat detection – Most ransomware attacks can be detected and resolved before it’s too late. To maximise your chances of protection, have automated threat detection in place in your organisation.

4. Adopt multifactor authentication – Multifactor authentication forces users to verify their identities in multiple ways before they’re granted access to a system. This way, if an employee mistakenly gives their password to a cybercriminal, the criminal won’t be able to gain easy access to your systems.

5. Scan and monitor emails and file activity – Emails are a common choice for cybercriminals executing phishing schemes, so take the time to scan and monitor emails on an ongoing basis, and consider deploying an automated email security solution to block malicious emails from ever reaching users.

Find out more at www.checkpoint.com

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

More is less in cybersecurity
Issue 2 2021 , Cyber Security
Post-pandemic paradox: more solutions do not bring better protection. Despite 80% of organisations running up to 10 different protection and cybersecurity solutions simultaneously, more than 50% of them experienced downtime from data loss last year.

Malware disguised as meeting apps spiked by 1067%
Issue 2 2021 , Cyber Security
Atlas VPN analysis reveals that cyber threats disguised as videoconferencing applications jumped by 1067% in a year. The data analysed was provided by Kaspersky.

The realities of AI in cybersecurity: catastrophic forgetting
Issue 2 2021 , Cyber Security
There is a lot of hype about the use of artificial intelligence (AI) in cybersecurity. The truth is that the role and potential of AI in security is still evolving and often requires experimentation and evaluation.

Cyber makes it secure
Issue 2 2021 , Cyber Security
Stas Protassov, Acronis co-founder and technology president comments on the recent hacking of over 150 000 Verkada surveillance cameras.

Security patches are not a plan
Issue 2 2021, Galix Group , Cyber Security
Patches are undoubtedly an essential component of a cybersecurity strategy, but with the current digital landscape, with many employees continuing to work from home, patches alone are not sufficient.

Sophos unveils XGS firewall appliances
Issue 2 2021 , Cyber Security
Sophos unveils XGS firewall appliances with optimised Transport Layer Security (TLS) inspection in light of new research that identifies a surge in cybercriminals using TLS to carry out attacks.

Kaspersky reveals five ways ransomware gangs play today
Issue 2 2021 , Cyber Security
] Over the past few years, the methods cybercriminals use to distribute ransomware has changed dramatically. While a few years ago, they would spread encrypted files on a large scale, today their ransomware attacks have become more focused.

Safe, friction-free user interactions
Issue 2 2021 , Cyber Security
F5 announced the addition of new SaaS products to its application security portfolio: Device ID and Shape Recognize make use of unique data and analytics capabilities, streamlining customer experiences by removing login friction for users while guarding against fraud.

Educating remote workers on cybersecurity
Issue 2 2021, J2 Software , Cyber Security
Cybercriminals have shifted their focus to vulnerable employees who now work from home and use personal Internet connections, requiring more education of remote workers on cybersecurity and better computer safety practices or risk having their data compromised.

Healthcare, cybersecurity and the COVID-19 vaccine supply chain
Issue 2 2021 , Cyber Security
Understanding why the COVID-19 vaccine supply chain is being targeted and how to protect against such attacks is vital for IT leaders who understand that healthcare and cybersecurity must now go hand-in-hand.