Check Point Research (CPR) reports a global surge in the number of ransomware attacks on various sectors including healthcare, manufacturing, BFSI, government and defense
Following the recent disclosure of vulnerabilities affecting Microsoft Exchange Servers, Check Point Research (CPR) has observed a global surge in the number of ransomware attacks. In fact, since the beginning of 2021, there has been a 9 percent increase monthly in organizations’ affected ransomware. This uptick includes a 57 percent increase in organizations affected by ransomware in the past six months. As per various industry reports and official alerts from the Cybersecurity and Infrastructure Security Agency (CISA) in the US, ransomware attacks are targeting Microsoft Exchange servers by leveraging previously exposed vulnerabilities.
In the last week alone, the number of attacks involving Exchange Server vulnerabilities has tripled. With over 50,000 attack attempts seen globally, CPR has observed that the most targeted industries include government, military, manufacturing and BFSI. The most affected country is the United States (49 percent of all exploit attempts), followed by the United Kingdom (5 percent), the Netherlands (4 percent) and Germany (4 percent).
Over the past year, hospitals and the healthcare industry have been under tremendous pressure during the COVID-19 pandemic, not only dealing with surges in patient numbers, but also with shameless ransomware attacks launched by cybercriminals who see the sector as a soft target. However, it now seems that criminals are shifting their attention to new targets, because they sense even easier opportunities for their extortion tactics.
In the meantime, WannaCry, the wormable ransomware that made its debut four years ago, is also trending again, though it is unclear why. Since the beginning of the year, the number of organizations affected with WannaCry globally has increased by 53 percent. In fact, CPR found that there are40 times more affected organizations in March 2021 when compared to October 2020. The new samples still use the EternalBlue exploit to propagate – for which patches have been available for over four years. This highlights why it’s critical that organizations patch their systems as soon as updates are available.
Global Ransomware Spikes
- In the past 6 months, there has been a general increase in the number of attacks involving human-operated ransomware, such as Maze and Ryuk, in which victims have to negotiate with the criminals that launched the attack.
- In the last 6 months, there has been a57% increase in the number of organizations affected by ransomware globally.
- Since the beginning of 2021, the number of organizations affected by ransomware have been growing at 9% monthly.
- In total, 3,868 organizations have been affected with ransomware
Qaisar
