{"id":24723,"date":"2022-12-20T13:41:38","date_gmt":"2022-12-20T13:41:38","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/20\/holiday-season-sees-onslaught-of-ransomware-ddos-attacks\/"},"modified":"2022-12-20T13:41:38","modified_gmt":"2022-12-20T13:41:38","slug":"holiday-season-sees-onslaught-of-ransomware-ddos-attacks","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/20\/holiday-season-sees-onslaught-of-ransomware-ddos-attacks\/","title":{"rendered":"Holiday Season Sees Onslaught of Ransomware, DDoS Attacks"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n

Ransomware and distributed denial-of-service attacks significantly increased from October to November of this year, a cybersecurity research company reported Tuesday.<\/p>\n

NCC Group<\/a> reported a 41% jump in ransomware attacks<\/a> in November, to 265 from 188 in October, making November the most active month for the malware since April.<\/p>\n

During the same period in 2021, the report continued, the increase was smaller (4%), but the totals were higher \u2014 314 for October and 328 for November.<\/p>\n

That is likely due to the Conti and Pysa gangs being heavy contributors to the ransomware threat landscape at the time, the report said. Both gangs are either dissolved or separated now.<\/p>\n

Seasonal variations in ransomware attacks are common, noted Marcus Smiley, CEO of Epoch Concepts<\/a>, an IT solutions provider based in Littleton, Colo.<\/p>\n

\u201cRansomware attacks have increased during the holiday season since at least 2018,\u201d Smiley told TechNewsWorld.<\/p>\n

\u201cThe simplest explanation is that companies wind down operations towards the end of the year, making them less responsive to cyberattacks than usual,\u201d he said. \u201cThis makes it a logical time to launch new ransomware campaigns.\u201d<\/p>\n

\u201cThere is definitely an increased risk of attacks during the holiday season,\u201d added Morgan Demboski, a threat intelligence analyst with IronNet<\/a>, a network security company in McLean, Va.<\/p>\n

\u201cThreat actors try to take advantage of a potential lower cybersecurity posture and response due to employees being on break for the holiday,\u201d Demboski told TechNewsWorld.<\/p>\n

In 2021, there was a drop in ransomware attacks in the fourth quarter as threat actors focused on quality, not quantity, noted James McQuiggan. a security awareness advocate at KnowBe4<\/a>, a security awareness training provider in Clearwater, Fla.<\/p>\n

\u201cHowever, this year, there have been increases in attacks targeting health care, education, and retail,\u201d McQuiggan told TechNewsWorld.<\/p>\n

A Malware for All Seasons<\/h3>\n

Attacks, in general, can often be tracked back to particular time periods, which will enable them to either blend in with expected, legitimate communications or to maximize their chances of a large payoff, explained Mark Guntrip, senior director of cybersecurity strategy at Menlo Security<\/a>, a cybersecurity company in Mountain View, Calif.<\/p>\n

\u201cAttacks against agriculture companies around harvest times have prompted warnings from the FBI,\u201d Guntrip told TechNewsWorld. \u201cThere have also been attacks against game manufacturers close to a big launch and candy manufacturers before Halloween and holidays.\u201d<\/p>\n

While ransomware attacks may have seasonal spikes, experts say the practice will continue to grow no matter what time of year it is.<\/p>\n

Ransomware Regional Analysis \u2013 November 2022<\/h4>\n

\"Chart<\/p>\n

As observed throughout the year, in November the top two regions targeted by ransomware globally remained North America, followed by Europe. (Source: NCC Group Monthly Threat Pulse)<\/p>\n\n

\u201cRansomware attacks have risen and will continue to rise in 2023,\u201d Guntrip said.<\/p>\n

\u201cFrom attacks on critical infrastructure to individual businesses, it\u2019s clear that in today\u2019s threat landscape, no one\u2019s systems are safe, and there are no signs of cybercriminals slowing down their efforts,\u201d he observed.<\/p>\n

\u201cThe level of success and subsequent money paid after an attack is an obvious attraction for threat actors to continue to increase their focus on ransomware,\u201d he added.<\/p>\n

Extortion Gaining Popularity<\/h3>\n

Increased opportunity is contributing to rising ransomware attacks, maintained Smiley. \u201cToday\u2019s organizations have more connected surfaces thanks to IoT and remote employment than ever before,\u201d he said.<\/p>\n

Another factor is motive. \u201cWith rising geopolitical conflict around the world, there is more activity from nation-state and politically driven actors,\u201d he observed.<\/p>\n

\u201cYet another factor,\u201d he added, \u201cis the increased number of ransomware-as-a-service groups who provide their services to less sophisticated cybercriminals for a fee.\u201d<\/p>\n

Demboski explained that \u201cas a service\u201d offerings have made ransomware a low-effort, low-risk option for generating criminal gains.<\/p>\n

\u201cThe availability of various ransomware families via ransomware-as-a-service, paired with other readily available services like phishing-as-a-service and initial access brokers, have made it very easy for cybercriminals to buy credentials and ready-made access to organizations, in essence giving them all the necessary ingredients to launch an effective and damaging ransomware attack,\u201d he said.<\/p>\n

<\/p>\n

<\/p>\n

\n
\n

ADVERTISEMENT<\/p>\n

\"Enhance<\/a> <\/div>\n<\/p><\/div>\n

<\/center><\/p>\n

A troubling trend that will further fuel ransomware attacks is the use of ransomware for extortion.<\/p>\n

\u201cWith the ransomware floodgates opening in recent months, there have been many cases of ransoms not being lifted after payment and data being held hostage for future extortion, including double and triple extortion,\u201d said Timothy Morris, chief security advisor at Tanium<\/a>, maker of an endpoint management and security platform in Kirkland, Wash.<\/p>\n

\u201cThis makes extortion the trend to keep in mind,\u201d Morris told TechNewsWorld. \u201cIt is easier to deal with than the logistics of ransomware keys and managing encryption\/decryption, which can create tech support issues that damage the \u2018reputation\u2019 of criminals syndicates if they fall short.\u201d<\/p>\n

DDoS Attacks Rising<\/h3>\n

As in October, the NCC report noted, distributed denial-of-service attacks continued to rise, with 3,648 spotted in November. A prime target of those was the United States, with 1,543 attacks.<\/p>\n

Reasons for the U.S. being the most targeted include the large attack surface and existing geopolitical tensions in the country, which show no sign of relaxing, the report explained.<\/p>\n

Given the timing, the U.S. attacks could have been intended to disrupt the mid-term elections, it added.<\/p>\n

NCC\u2019s Global Head of Threat Intelligence, Matt Hull, predicted that DDoS attacks would likely continue to rise.<\/p>\n

\u201cHowever, as more organizations become aware of the increased threat, it will be interesting to see how malicious actors employing DDoS attacks are countered,\u201d he said in a statement. \u201cDDoS is not a new attack type, and preventative and defensive measures are more widely available and affordable than ever before.\u201d<\/p>\n

DDoS Not for Ransomware Crowd<\/h3>\n

While denial-of-service attacks were common with some cybercriminal groups, there has been a reduction in DDoS attacks relating to ransomware, noted McQuiggan.<\/p>\n

\u201cThis action could be a result of preventing the victim organization from utilizing the internet to get to the Tor network, making it very difficult to pay,\u201d he explained.<\/p>\n

\u201cIf they do launch the denial of service,\u201d he continued, \u201cit\u2019s to let the organization know that they are still susceptible to other attacks to continue the threat.\u201d<\/p>\n

There seems to be less of a concern over DDoS attacks compared with data breaches, malware, and phishing because DDoS attacks typically do not result in the theft or loss of sensitive data, observed Casey Ellis, CTO and founder of Bugcrowd<\/a>, an operator of a crowdsourced bug bounty platform.<\/p>\n

\u201cWhile DDoS attacks can cause significant disruption to a company\u2019s operations, they do not pose the same level of risk to the confidentiality, integrity, or availability of critical data as other types of cyberattacks,\u201d Ellis told TechNewsWorld. \u201cDDOS attacks are less sophisticated and easier to defend against compared to data breaches, malware, and phishing attacks.\u201d<\/p>\n<\/p><\/div>\n