At gunpoint of cyber-blackmailers

[root]

Banks, government agencies, transport are the main targets of ransomware in 2021

This year, blackmail malware operators have most frequently targeted organizations in the banking and transportation sectors, as well as government agencies. The reasons for this are that the shutdown of such enterprises can affect the national security, economic stability and security of the population of entire countries and, therefore, allows you to count on the quick payment of large ransoms. In this article, Trend Micro* CTO in the CIS, Georgia and Mongolia, Mikhail Kondrashin, shared some details about ransomware attacks in 2021 collected by the company's global detection network.

SITUATION IN GENERAL

Ransomware or ransomware is a type of malicious software designed to extort money by blocking access to a computer system or preventing the data written to it from being read (often using encryption techniques) and then demanding a ransom from the victim to restore the original state.

According to our observations, the total number of attempts to attack enterprises using such software has reached 3.6 million, with banks, government agencies and transport closely followed by organizations and enterprises in other critical sectors that have undergone major changes in business continuity in recent months .

Number of ransomware attacks by economic sector . Source (hereinafter): Trend Micro

Among countries, the leaders in the number of ransomware attacks in 2021 were Mexico, India and the United States.


Number of ransomware attacks by country in 2021

WannaCry accounted for the largest number of detections​

This is because organizations around the world continue to use a significant number of outdated and out-of-date operating systems that are vulnerable to this network worm.

Of the new extortionist families, REvil and Ryuk became leaders

Next, we will consider in more detail the banking, government and transport sectors.





FINANCIAL SECTOR


Banks have traditionally been an attractive target for cybercriminals, and ransomware operators are no exception. After all, it is in banks that you can not only get a ransom, but also steal credit card data and funds from accounts.


In 2021, Trend Micro sensors recorded more than 130,000 ransomware attacks on banks, with the majority of incidents occurring at financial companies in North, Central and South America.


Ransomware attacks on banks by region

On average, each bank customer has five accounts.

A successful attack on an employee or the infrastructure of one bank branch can affect at least 9,000 customers and more than 45,000 accounts​

Small and medium banks can be used to attack more organizations in the financial industry and beyond through various service platforms. Stopping or closing these local branches could have a significant impact on communities and other critical sectors.

Ransom payments to extortionists have the potential to violate legal regulations such as anti-money laundering and counter-terrorist financing laws, as well as the full customer information (KYC) rule**.


HUNTING FOR STATE DATA

Government agencies attract ransomware for many reasons. One of them is the personal data of citizens in information systems. Their theft or blocking access with the help of encryption serve as a powerful lever to put pressure on the victim.

Besides,

modern ransomware operators can make additional profit by selling stolen data to other cybercriminal groups​

In 2021, Trend Micro recorded more than 82,000 ransomware attacks against government agencies, with the highest number in the Africa region, followed by Asia and the Middle East.

Ransomware attacks on the public sector by region

The operators of the well-known ransomware Stop, Cerber, Locky, and GandCrab carried out the bulk of the attacks on the public sector, but the relatively new ransomware variants REvil and Crysis also had a significant impact on the overall picture.





ON GROUND, ON WATER AND IN THE AIR

From 2019 to 2021, the number of ransomware attacks on the transport industry increased by 186%​

Given the close interconnection between air, sea, and land transportation, the sudden disruption of any of these routes has a massive impact on business, human well-being, and national security, as well as a potentially big win for attackers.

It is noteworthy that not only the vehicles’ own IT systems are vulnerable to attacks, but also ground/shore, as well as devices in data centers and offices used to manage logistics operations.

Trend Micro sensors recorded more than 32,000 ransomware attacks on transportation businesses in 2021. The largest number of incidents was observed in Asia and the Middle East.

Ransomware attacks on the transport industry by region

The first major ransomware attack in the US rail freight sector was reported in January 2021. OmniTRAX, an industry company, has confirmed that it has been attacked by the Conti ransomware gang. The attackers encrypted the victim's systems and published the stolen data on a leak site. One of the latest attacks on the transport industry has been linked to the Death Kitty program and nearly brought South Africa's ports to a complete halt.

PROTECTION BASICS
Ransomware attacks are becoming more targeted.

Cybercriminals carefully prepare for an attack, perform deep profiling of victims, choosing the most “monetary” and vulnerable targets​

Phishing and software vulnerabilities are still the most commonly used to penetrate the system.

Thus, the following measures will help protect against ransomware:

• setting up continuous learning and awareness programs for all employees and partners of the organization;
• implementation of multi-level solutions for detecting and responding to threats;
• establishing incident response teams and action programs to prevent and recover from cyberattacks;
• implementation of comprehensive update management programs;
• regular simulations of attacks to train the skills of safe behavior among employees.

_____
* Trend Micro is a Japanese cybersecurity software company.
** KYC - Know Your Customer or Know Your Client ("Know your client"). This is the principle of activity of financial institutions (banks, exchanges, bookmakers, investment and mutual funds), obliging them to identify the identity of the counterparty before conducting a financial transaction.


Images: RSpectr, Pexels.com, Trend Micro

A source

 

[НСК-СБ]

You have to pay for security, and pay for its absence.
Winston Churchill.

 

[Alexander Konovalenko.]

За безопасность необходимо платить, а за ее отсутствие расплачиваться.
Уинстон Черчиль.

Полностью согласен.

 

[частный детектив. Узбекистан. Ташкент.]

At this rate, the whole economy is kapets soon (

 

[Частный детектив. Москва.]

Then you need to improve the defense, right?

 

[Детективное агентство Израиль.]

You have to be careful.

 

[David Mamedov]

You have to be careful.

This all should be sent to the peaceful banks, although this is not our business.

 

[alexsey1417]

And there are more and more such ransomware. There are even whole groups.

 

[Частный детектив. Армения. Ереван.]

Ohh, I don't envy Mexico.

 

[Частный детектив Азербайджан]

I wonder why in America extortion is so developed?