Ransomware and Microsoft Exchange attacks surging

There are global surges in ransomware attacks alongside increases in cyber attacks targeting Microsoft Exchange Server vulnerabilities, according to Check Point Research.

The two trends are spotted at a time where CISA has raised alarm about ransomware attacks against Microsoft Exchange servers, in addition to recent reports of ransomware groups deploying malicious strains that leverage Exchange vulnerabilities.

Recently, CPR has spotted the following trends and data around ransomware attacks based on organizations it tracks:

• Since October 2020, there has been a 57% increase in the number of organisations affected by ransomware globally
• Since the beginning of 2021, the number of organisations affected by ransomware has been growing at 9% month over month
• In the past 6 months, there has been a general increase in the number of attacks involving human-operated ransomware, such as Maze and Ryuk
• In total, 3,868 organisations have been affected

 
CPR has identified the top 3 countries that saw the most ransomware attack attempts as USA (12%), Israel (8%) and India (7%), while the top 3 industry sectors that saw the most ransomware attack attempts as Government/Military (18%), Manufacturing (11%), Finance/Banking (8%).

Cyber Attacks Targeting Microsoft Exchange Servers Go Up

Recently, CPR has spotted the following trends and data around cyber attacks that have targeted Microsoft Exchange Servers based on organisations it tracks:

• In the last week, the number of attacks involving Exchange Server vulnerabilities has tripled
• Over 50,000 attack attempts has now been documented by CPR on Microsoft Exchange Servers
• The most targeted industries are government/military, manufacturing and then banking/finance.
• The most affected country is the United States (49% of all exploit attempts), followed by the United Kingdom (5%), the Netherlands (4%) and Germany (4%)

WannaCry Trends, Again

WannaCry is trending again. WannaCry is a ransomware worm that spread rapidly through across a number of computer networks in May of 2017. After infecting a Windows computers, it encrypts files on the PC's hard drive, making them impossible for users to access, then demands a ransom payment in bitcoin in order to decrypt them.

CPR has spotted the following trends and data around WannaCry based on organisations it tracks:

• Since the beginning of the year, the number of organisations affected with WannaCry globally has increased by 53%
• There are 40 times more affected organisations in March 2021, when compared to October 2020
• The new samples still use the EternalBlue exploit to propagate
   

"Two trends are happening concurrently. One, cyber attacks targeting Microsoft Exchange servers are increasing sharply. Two, ransomware attacks are simultaneously rising steadily," says CPR manager of threat intelligence, Lotem Finkelsteen.

"Although we have not concluded that the two trends are directly related just yet, there is reason for concern.

"We do believe the Microsoft Exchange vulnerabilities opened up another door into organidations. And so, Check Point Research is also raising the alarm bells, just like CISA has.

"We're urging organidations to act now, before ransomware gangs make Exchange exploits popular. In cyber crime, we rarely see businesses that demonstrate constant growth, or rapid adjustments to changing factors, as well as quick  adoptions of new technologies. Ransomware is one of those rare businesses.

How Organisations can Protect Against Ransomware

• Back up all data - One of most important tasks is backing up your company's data. If something goes wrong, your data should be able to quickly and easily revert to a previous version.
• Keep software updated - Ransomware attackers sometimes find an entry point within apps and software, noting vulnerabilities and capitalising on them. Fortunately, some developers actively search for new vulnerabilities and patch them.
• Utilise better threat detection - Most ransomware attacks can be detected and resolved before it's too late. To maximise your chances of protection, have an automated threat detection in place in your organisation.
• Adopt multifactor authentication - Multifactor authentication forces users to verify their identities in multiple ways before they're granted access to a system. This way, if an employee mistakenly gives their password to a cybercriminal, the criminal won't be able to gain easy access to your systems.
• Scan and monitor emails and file activity - Emails are a common choice of cybercriminals executing phishing schemes, so take the time to scan and monitor emails on an ongoing basis, and consider deploying an automated email security solution to block malicious emails from ever reaching users.