Ransomware and Microsoft Exchange Server attacks are surging

Issue 2 2021 Information Security

Check Point Research (CPR) is observing global surges in ransomware attacks, alongside an increase in cyberattacks targeting vulnerabilities in Microsoft Exchange servers. The revelation comes at a time when CISA (the USA’s Cybersecurity and Infrastructure Security Agency) has raised alarm bells about ransomware attacks against Microsoft Exchange servers, in addition to other security researchers who have already detected at least two groups leveraging Microsoft Exchange vulnerabilities to infect victims with ransomware, the BlackKingdom ransomware group and another unknown group deploying a new malware strain called DearCry.

CPR has spotted the following trends and data around ransomware attacks based on organisations it tracks:

Since October 2020, there has been a 57% increase in the number of organisations affected by ransomware globally.

• Since the beginning of 2021, the number of organisations affected by ransomware has been growing at 9% month over month.

• In the past six months, there has been a general increase in the number of attacks involving human-operated ransomware, such as Maze and Ryuk.

• In total, 3868 organisations have been affected.

• The top three countries that saw the most ransomware attack attempts are USA (12%), Israel (8%) and India (7%).

• The top three industry sectors that saw the most ransomware attack attempts are government/military (18%), manufacturing (11%), and finance/banking (8%).

CPR also found the following trends and data around cyberattacks that have targeted Microsoft Exchange servers:

The number of attacks involving Exchange server vulnerabilities has tripled.

• Over 50 000 attack attempts have now been documented by CPR on Microsoft Exchange servers.

• The most targeted industries are government/military, manufacturing and then banking/finance.

• The most affected country is the United States (49% of all exploit attempts), followed by the United Kingdom (5%), the Netherlands (4%) and Germany (4%).

WannaCry trends, again

WannaCry is trending again. WannaCry is a ransomware worm that spread rapidly through a number of computer networks in May of 2017. After infecting a Windows computer, it encrypts files on the PC’s hard drive, making them impossible for users to access, then demands a ransom payment in bitcoin in order to decrypt them. CPR has spotted the following trends and data around WannaCry:

Since the beginning of the year, the number of organisations affected by WannaCry globally has increased by 53%.

• There are 40 times more affected organisations in March 2021 when compared to October 2020.

• The new samples still use the EternalBlue exploit to propagate.

Lotem Finkelsteen, Check Point's manager of threat intelligence, comments: “Two trends are happening concurrently. One, cyberattacks targeting Microsoft Exchange servers are increasing sharply. Two, ransomware attacks are simultaneously rising steadily. Although we have not concluded that the two trends are directly related just yet, there is reason for concern. We do believe the Microsoft Exchange vulnerabilities opened up another door into organisations. And so Check Point Research is also raising the alarm bells, just like CISA has. We’re urging organisations to act now, before ransomware gangs make Exchange exploits popular. In cybercrime, we rarely see businesses that demonstrate constant growth, or rapid adjustments to changing factors, as well as quick adoptions of new technologies. Ransomware is one of those rare businesses.”

How organisations can protect against ransomware

1. Back up all data – One of the most important tasks is backing up your company’s data. If something goes wrong, your data should be able to quickly and easily revert to a previous version.

2. Keep software updated – Ransomware attackers sometimes find an entry point within apps and software, noting vulnerabilities and capitalising on them. Fortunately, some developers actively search for new vulnerabilities and patch them.

3. Use better threat detection – Most ransomware attacks can be detected and resolved before it’s too late. To maximise your chances of protection, have automated threat detection in place in your organisation.

4. Adopt multifactor authentication – Multifactor authentication forces users to verify their identities in multiple ways before they’re granted access to a system. This way, if an employee mistakenly gives their password to a cybercriminal, the criminal won’t be able to gain easy access to your systems.

5. Scan and monitor emails and file activity – Emails are a common choice for cybercriminals executing phishing schemes, so take the time to scan and monitor emails on an ongoing basis, and consider deploying an automated email security solution to block malicious emails from ever reaching users.

Find out more at www.checkpoint.com




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Upgrade your PCs to improve security
Information Security Infrastructure
Truly secure technology today must be designed to detect and address unusual activity as it happens, wherever it happens, right down to the BIOS and silicon levels.

Read more...
Open source code can also be open risk
Information Security Infrastructure
Software development has changed significantly over the years, and today, open-source code increasingly forms the foundation of modern applications, with surveys indicating that 60 – 90% of the average application's code base consists of open-source components.

Read more...
DeepSneak deception
Information Security News & Events
Kaspersky Global Research & Analysis researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs.

Read more...
SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Survey highlights cost of cyberdamage to industrial companies
Kaspersky Information Security News & Events
The majority of industrial organisations estimate their financial losses caused by cyberattacks to be over $1 million, while almost one in four report losses exceeding $5 million, and for some, it surpasses $10 million.

Read more...
Digital economy needs an agile approach to cybersecurity
Information Security News & Events
South Africa is the most targeted country in Africa when it comes to infostealer and ransomware attacks. Being at the forefront of the continent’s digital transformation puts South Africa in the crosshairs for sophisticated cyberattacks

Read more...
SIEM rule threat coverage validation
Information Security News & Events
New AI-detection engineering assistant from Cymulate automates SIEM rule validation for SecOps and blue teams by streamlining threat detection engineering with automated testing, control integrations and enhanced detections.

Read more...
Cybersecurity a challenge in digitalising OT
Kaspersky Information Security Industrial (Industry)
According to a study by Kaspersky and VDC Research on securing operational technology environments, the primary risks are inadequate security measures, insufficient resources allocated to OT cybersecurity, challenges surrounding regulatory compliance, and the complexities of IT/OT integration.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.