Ransomware Blamed for Every Third Cyber Incident, Kaspersky Reports

Ahead of International Anti-Ransomware Day on May 12, Kaspersky’s latest research revealed one in every three cyber incidents was a ransomware attack in 2023.

The report highlights a 30% increase in targeted ransomware groups compared to 2022 and a 71% surge in known victims.

Unlike random assaults, these groups target government agencies, prominent organizations, and specific individuals in sophisticated and extensive attacks, posing a growing cybersecurity threat.

In 2023, Lockbit 3.0 became the most widespread ransomware, while BlackCat/ALPHV came second until the FBI and other agencies disrupted its operations in December 2023. Cl0p ranked third, affecting over 2.5 thousand organizations by December 2023.

Ransomware groups use contractors and service providers to efficiently carry out attacks, exploit network vulnerabilities, and use various tools and techniques. They infiltrate their victims using well-known security tools, public-facing vulnerabilities, and native Windows commands. Robust cybersecurity measures are necessary to defend against ransomware attacks and domain takeovers.

“To combat this pervasive threat, it’s imperative for individuals and organizations to fortify their defenses with robust cybersecurity measures. Deploying solutions such as Kaspersky Endpoint Security and embracing Managed Detection and Response (MDR) capabilities are pivotal steps in safeguarding against evolving ransomware threats,” commented Dmitry Galov, head of the research center, Kaspersky’s GReAT.

Kaspersky recommends these practices to protect against ransomware attacks:

• Always keep software updated on all your devices to prevent attackers from exploiting vulnerabilities and infiltrating your network.
• Focus your defense strategy on detecting lateral movements and data exfiltration to the internet. Pay special attention to outgoing traffic to detect cybercriminals’ connections to your network. Set up offline backups that intruders cannot tamper with. Make sure you can access them quickly when needed or in an emergency.
• Enable ransomware protection for all endpoints. The free Kaspersky Anti-Ransomware Tool for Business shields computers and servers from ransomware and other types of malware prevents exploits, and is compatible with already installed security solutions.
• Install anti-APT and EDR solutions, enabling capabilities for advanced threat discovery and detection, investigation, and timely remediation of incidents. Provide your SOC team access to the latest threat intelligence and regularly upskill them with professional training. All of the above is available within the Kaspersky Expert Security framework.
• Provide your SOC team access to the latest threat intelligence (TI). The Kaspersky Threat Intelligence Portal is a single access point for Kaspersky’s TI, providing cyberattack data and insights gathered by our team for over 20 years. To help businesses enable effective defenses in these turbulent times, Kaspersky has announced access to independent, continuously updated, and globally sourced information on ongoing cyberattacks and threats at no charge. Request access to this offer here.