Saturday , November 23 2024
Ransomware
Ransomware red button on keyboard, 3D rendering

Corvus threat intel report
Ransomware Attacks Up More Than 95% Over 2022

In its Q2 2023 Global Ransomware Report, Corvus noted a significant resurgence in global ransomware attacks, which has continued through the third quarter. Now, with two months remaining in the year, the number of ransomware victims in 2023 has already surpassed what was observed for 2021 and 2022. If the trajectory continues, 2023 will be the first year with more than 4,000 ransomware victims posted on leak sites (2,670 in 2022).

           Corvus Threat Intel report

2023 has already seen more ransomware victims than all of 2021 and 2022 combined. If this trend continues, there could be over 4,000 ransomware victims posted on leak sites this year.

CERT-In Flags Multiple Critical Vulnerabilities in Zoom app

CERT-In issued a security advisory for multiple vulnerabilities in the Zoom app that could let attackers access sensitive information, escalate...
Read More
CERT-In Flags Multiple Critical Vulnerabilities in Zoom app

Daily Security Digest Dated 11/23/24

Every day a lot of cyberattack happenings around the world including ransomware, Malware attack, data breaches, website defacement and so...
Read More
Daily Security Digest Dated 11/23/24

SafetyDetectives’ Research
Malware evades Microsoft Defender and 2FA, stealing $24K in crypto (video)

SafetyDetectives researchers found that Microsoft Defender was tricked by malware which allowed cryptocurrency theft from a user while analyzing a...
Read More
SafetyDetectives’ Research  Malware evades Microsoft Defender and 2FA, stealing $24K in crypto (video)

Over 145,000 ICS Across 175 Countries Found Exposed Online

A study by Censys found that more than 145,000 Industrial Control Systems (ICS) are exposed online in 175 countries, highlighting...
Read More
Over 145,000 ICS Across 175 Countries Found Exposed Online

World to see AI powered “human washing machines”

Osaka-based showerhead maker Science Co. is developing a new version of human washing machine based on cutting-edge technology. The company...
Read More
World to see AI powered “human washing machines”

Hacker compromised over 2000 Palo Alto Networks Firewalls

Over 2,000 Palo Alto Networks firewalls have been compromised in a widespread attack using two recently patched vulnerabilities (CVE-2024-0012 and...
Read More
Hacker compromised over 2000 Palo Alto Networks Firewalls

“Forces Penpals” exposed US and UK Military Social Network’s 1 Million Records

Renowned cybersecurity researcher Jeremiah Fowler uncovered a non-password-protected database having over 1.1 million records linked to Conduitor Limited (Forces Penpals)....
Read More
“Forces Penpals” exposed US and UK Military Social Network’s 1 Million Records

CVE-2024-51503
Trend Micro released updates for Deep Security Agent RCE

Trend Micro released a security update for Deep Security 20 Agent Manual Scan Command Injection RCE Vulnerability (CVE-2024-51503) that resolves...
Read More
CVE-2024-51503  Trend Micro released updates for Deep Security Agent RCE

Apple Releases Patch for two Actively Exploited Zero-Day

Apple released critical updates for its various products including for iOS, iPadOS, macOS, visionOS, and Safari to fix two zero-day...
Read More
Apple Releases Patch for two Actively Exploited Zero-Day

Maxar Space Data Leak, Company admit, Investigation ongoing!

Maxar Space Systems has verified a major data breach that exposed particular information of current and former workers. The breach...
Read More
Maxar Space Data Leak, Company admit, Investigation ongoing!
     Corvus Threat Intel report
Note that this is not the complete picture. Victims who are listed on leak sites usually do not pay or delay paying a ransom. However, a significant portion of victims, estimated to be between 27% – 41%, promptly pay the demands of threat actors and therefore are not seen on leak sites.
As a result, the total number of businesses affected by ransomware could be approximately 5,500 – 7,000 in 2023.

Factors Contributing to the Global Ransomware Surge

CL0P Mass Exploits Peaked:

CL0P, a previously quiet ransomware group, became active in Q1 by exploiting GoAnywhere file transfer software and impacting over 130 victims. In Q2, they targeted MOVEit file transfer software using a zero-day vulnerability, affecting 264 victims. This single vulnerability accounted for 9% of Q2’s total and 13% of Q3’s victims, significantly contributing to an increasing victim count.

However, even without CL0P, ransomware numbers increased by 5% compared to the previous quarter and 70% compared to the previous year in Q3.

The graph below illustrates the significant impact of a single group like CL0P, which was once relatively quiet.

Prior to 2023, CL0P only had a small number of ransomware victims. Now, they make up a considerable share of the total. A single opportunity for mass exploitation can lead to record-breaking results for a ransomware group.

        Corvus Threat Intel report
The grey bars show the activity of ransomware groups, excluding CL0P. These bars have been increasing steadily in 2023. Even without CL0P, ransomware activity is increasing.
Each quarter of this year has been higher than the previous one. Based on past trends, Q4 is expected to be worse than Q3.
     Corvus Threat Intel report
LockBit and ALPHV (BlackCat) reduced the number of victims on their leak sites by around 50% from April to July 2023. However, the latest numbers from late Q3 and early Q4 indicate that ransomware groups are returning to their usual activities and are expected to cause more harm in Q4.
  Corvus Threat Intel report

 

 

Check Also

diagram

“Sarcoma” ransomware group
Hacker to disclose “Popular Life Insurance” 36 GB of stolen data

“Sarcoma” ransomware group attacked a well known Bangladeshi insurance company named “Popular life insurance company …

Leave a Reply

Your email address will not be published. Required fields are marked *