Ransomware: Attacks and ransoms are falling, but caution is always needed
Ransomware
From a report by the US insurer Corvus Insurance, interesting data emerges on ransomware and its effects from 2021 to the first quarter of 2022. The research is based on data obtained on the reporting of attacks of this type, and suggests a decline in both breaches and in ransomware paid by affected companies.Encouraging data, according to the company, is a decline in reports of ransomware attacks that fell from 0.58% to 0.25% between the first and fourth quarters of 2021 . Furthermore, compared to a peak in ransoms paid during the third quarter of 2021 (equal to approximately US $ 167,000), in the last three months of the year, there was a further decline of 44.2%. These payments also fell relative to total redemption requests. One of the reasons behind this data is probably greater stringency in the requirements for accessing insurance coverage, which now requires more effective backup systems, as well as the use of the best antivirus to protect against ransomware.
Analyzing the data, the company also found some peaks attributable to cases of significant crimes, not to mention the cyber-war that is accompanying the Russian-Ukrainian conflict, with hacking actions from both the Russian and the opposite front.
| ); }
In general, what emerges from the research of Corvus is that small and medium-sized businesses are still working on their investments in cybersecurity, as evidenced by interviews conducted with approximately 300 participants including IT administrators, vice presidents, directors and board members of various SMEs.
The worrying figure is that only 8% of the smallest companies (less than 50 employees) have a budget dedicated to cybersecurity, although an increase in investments is expected.
Ransomware can be really insidious, but above all expensive for companies and individuals. Here are some of the best antiviruses that we recommend you to consider to defend yourself against this malware:
Bitdefender Antivirus, one of the best security packages ever
Bitdefender Total Security is an impressive suite with tons of features, if you are looking for an all-encompassing product, this might be for you. In addition, Bitdefender's anti-ransomware system is effective and well thought-out.
SEE OFFER
Norton, an antivirus also effective against ransomware
Norton is one of the best antivirus on the market, which we recommend unreservedly, also for its ransomware protection system.
SEE OFFER
Trend Micro Maximum Security
Trend Micro Maximum Security provides advanced protection for Windows and Android devices, more than enough on macOS and outperform most competitors on iOS. Its ransomware protection is one of the most effective.
SEE OFFER
Ransomware: These two gangs are behind half of all attacks
Over half of all ransomware attacks reported during the first three months of this year are the work of just two cyber criminal outfits.
According to analysis of recorded ransomware attacks between January and March 2022 by cybersecurity researchers at Digital Shadows, LockBit 2.0 and Conti were the two most active ransomware gangs during the three-month reporting period, accounting for 58% of all incidents.
And of the two, LockBit is by far the most prolific, accounting for 38% of ransomware attacks. That's almost twice the number of recorded attacks by the Conti ransomware group, which accounted for 20% of campaigns in the same period.
Both groups steal data from their victims and threaten to publish it on leak sites if the ransom isn't paid. According to Digital Shadows, LockBit leaked the information of over 200 victims during the first quarter of the year – the most leaks thus far.
While these two gangs were the busiest, other threats included Hive ransomware, Vice Society ransomware and Blackbyte ransomware, among others.
SEE: Cybersecurity: Let's get tactical (ZDNet special report)
Conti ransomware has remained a major threat, despite February's Conti Leaks, which revealed much about the inner workings of the ransomware group. Internal chat logs and other information got leaked after Conti publicly posted a message of support for Russia's invasion of Ukraine. But this setback doesn't seem to have dissuaded those behind Conti, who continue to conduct ransomware attacks.
'While the Conti chat leak is likely to have some impact on the group, it is unlikely that this will significantly affect the group's market share. Conti has shown no signs of slowing down since the chat logs and source code leak,' Ivan Righi, senior cyber threat intelligence analyst at Digital Shadows told ZDNet.
'However, the leak is a blow to the group's reputation, and could therefore affect its ability to attract new affiliates and have a long-term impact on its ability to grow,' he added.
One ransomware group does seem to have disappeared. Researchers note that PYSA ransomware, which was the third most active ransomware group during the final three months of 2021 appears to have dropped off the radar. Another previously prolific ransomware group, Revil, also appears to have stopped operating.
But while some ransomware groups seem to disappear, other new ransomware threats continue to appear. Some new ransomware groups which have appeared since January 2022 which have been listed by Digital Shadows include Stormous, Night Sky, Zeon, Pandora, Sugar, and x001xs. It's likely that individuals involved in groups which shut down simply find new work with other ransomware gangs.
'New ransomware groups are created at a similar rate to groups being shut down. This is likely because affiliates frequently move from groups that are no longer active to those that are emerging,' said Righi.
'Regardless of the external factors and shifts in targeting, ransomware is likely to remain one of the biggest threats to organizations worldwide over the next quarter,' he added.
There are several steps which businesses can take to avoid falling victim to ransomware. These include applying security patches to software and operating systems as quickly as possible, so cyber criminals can't exploit known vulnerabilities to enter and exploit networks.
Organisations should also roll out multi-factor authentication to all users to provide an extra barrier to attacks and if it's suspected that a password has been hacked, it should be changed immediately.
MORE ON CYBERSECURITY
