LockBit Dominates Ransomware Campaigns in 2022: Deep Instinct

The LockBit Ransomware-as-a-Support (RaaS) team accounted for 44% of all ransomware strategies in 2022, followed by Conti (23%), Hive (21%), Black Cat (7%) and Conti Splinters (5%), the latter team comprising menace actors from Quantum, BlackBasta and BlackByte.

The figures appear from the 2022 Interim Cyber Risk Report by Deep Instinct, which the business has shared with Infosecurity.

“2022 has been a different record 12 months for cyber-criminals and ransomware gangs,” commented Mark Vaitzman, danger lab group leader at Deep Instinct. “It’s no mystery that these menace actors are continually upping their recreation with new and enhanced techniques developed to evade standard cyber defenses.”

The report also examined the important adjustments to Agent Tesla, NanoCore and other menace groups, these kinds of as Emotet, commencing to use very obfuscated Visible Basic for Programs (VBA) macros to stay away from detection.

Much more normally, the Deep Intuition investigation has showed that as Microsoft started disabling macros by default in Microsoft Workplace files, the use of documents for malware lowered as the variety a single attack vector, replaced by LNK (Windows shortcut data files), HTML and archive email attachments.

Even further, the report stated that vulnerabilities like SpoolFool, Follina and DirtyPipe highlighted the exploitability of both Windows and Linux devices, suggesting that the quantity of exploited in-the-wild flaws spikes each individual 3 to four months.

Yet another trend spotted by Deep Instinct relates to danger actor groups making use of data exfiltration in their attack flows to demand from customers ransom for leaked facts.

In instances wherever delicate information is exfiltrated, there are fewer remediation alternatives. So, many risk actors also demand ransoms from 3rd-get together companies if the leaked information is made up of their delicate facts.

The Deep Intuition report has also provided three predictions for the potential, the initial of which has prompt that threat actors will keep on to glimpse for the weakest website link to initiate their assaults, irrespective of whether represented by a vulnerable process or an staff ready to be paid out to market details accessibility.

The 2nd prediction related to the rise of ‘protestware,’ the practice of self-sabotaging one’s software program and weaponizing it with malware abilities, and the 3rd a single linked to risk actors exploiting more unpatched vulnerabilities by the conclude of the calendar year.

“Defenders will have to proceed to be vigilant and locate new approaches to reduce these assaults from occurring,” Vaitzman concluded.

The Deep Instinct report arrives days after Ivanti printed a separate doc suggesting ransomware has developed by 466% given that 2019 and is progressively currently being used as a precursor to physical war.

Some parts of this article are sourced from:
www.infosecurity-journal.com