The holiday season sees the onslaught of ransomware and DDoS attacks

Ransomware and distributed denial-of-service attacks increased dramatically from October to November this year, a cybersecurity research firm reported on Tuesday.

NCC Group reported a 41% increase in ransomware attacks in November, to 265 from 188 in October, making November the busiest month for malware since April.

Over the same period in 2021, the report continues, the increase was smaller (4%), but the totals were higher – 314 for October and 328 for November.

This is likely because the Conti and Pysa gangs were big contributors to the ransomware threat landscape at the time, according to the report. Both gangs are either disbanded or separated now.

Seasonal variations in ransomware attacks are common, noted Marcus Smiley, CEO of Epoch Concepts, an IT solutions provider based in Littleton, Colorado.

“Ransomware attacks have increased during the holiday season since at least 2018,” Smiley told TechNewsWorld.

“The simplest explanation is that companies are shutting down operations towards the end of the year, making them less responsive to cyberattacks than usual,” he said. “This makes it a logical time to launch new ransomware campaigns.”

“There is definitely an increased risk of attacks during the holiday season,” added Morgan Demboski, threat intelligence analyst at IronNet, a network security company in McLean, Virginia.

“Threat actors are trying to take advantage of a potentially weaker cybersecurity posture and response due to employee vacation breaks,” Demboski told TechNewsWorld.

In 2021, there was a decline in ransomware attacks in the fourth quarter, with threat actors focusing on quality, not quantity, noted James McQuiggan. a security awareness advocate at KnowBe4, a security awareness training provider in Clearwater, Florida.

“However, this year there has been an increase in attacks targeting healthcare, education and retail,” McQuiggan told TechNewsWorld.

Malware for all seasons

Attacks, in general, can often be traced back to particular time periods, allowing them to either blend in with expected legitimate communications or maximize their chances of a big payoff, explained Mark Guntrip, senior director of the cybersecurity strategy at Menlo Security. , a cybersecurity company in Mountain View, California.

“Attacks on agricultural businesses at harvest time prompted warnings from the FBI,” Guntrip told TechNewsWorld. “There have also been attacks on game makers close to a big launch and candy makers ahead of Halloween and the holidays.”

While ransomware attacks can have seasonal spikes, experts say the practice will continue to grow regardless of the time of year.

Regional Ransomware Analysis – November 2022

As observed throughout the year, in November the top two regions targeted by ransomware worldwide remained North America, followed by Europe. (Source: Monthly NCC Group Threat Pulse)

---

“Ransomware attacks have increased and will continue to increase in 2023,” Guntrip said.

“From attacks on critical infrastructure to individual businesses, it’s clear that in today’s threat landscape, no system is secure and there are no signs that cybercriminals are slowing down their efforts.” he observed.

“The level of success and the money paid out after an attack is a clear attraction for threat actors to keep focusing more on ransomware,” he added.

Extortion is growing in popularity

The increase in opportunities contributes to the increase in ransomware attacks, Smiley asserted. “Organizations today have more connected surfaces thanks to IoT and remote employment than ever before,” he said.

Another factor is the pattern. “With the rise of geopolitical conflicts around the world, there is more activity from nation states and political actors,” he observed.

“Yet another factor,” he added, “is the increased number of ransomware-as-a-service groups providing their services to less sophisticated cybercriminals for a fee.”

Demboski explained that “as a service” offerings have made ransomware a low-effort, low-risk option for generating criminal gains.

“The availability of various ransomware families through ransomware-as-a-service, coupled with other readily available services like phishing-as-a-service and initial access brokers, has enabled cybercriminals to buy very easily credentials and out-of-the-box access to organizations, essentially giving them all the ingredients needed to launch an effective and damaging ransomware attack,” he said.

PUBLICITY

A disturbing trend that will further fuel ransomware attacks is the use of ransomware for extortion purposes.

“With the ransomware floodgates opening in recent months, there have been numerous instances of ransoms not being lifted after payment and data being held hostage for future extortion, including double and triple extortion,” said Timothy Morris. , chief security advisor at Tanium, maker of an endpoint management and security platform in Kirkland, Wash.

“That makes extortion the trend to keep in mind,” Morris told TechNewsWorld. “It’s easier to manage than ransomware key logistics and encryption/decryption management, which can create technical support issues that damage the ‘reputation’ of criminal syndicates if they fail.”

DDoS attacks are on the rise

As in October, the NCC report notes, distributed denial of service attacks continued to rise, with 3,648 spotted in November. One of the main targets for these was the United States, with 1,543 attacks.

The reasons why the United States is the most targeted include the large attack surface and the existing geopolitical tensions in the country, which show no signs of letting up, the report explains.

Given the timing, the US attacks could have been aimed at disrupting the midterm elections, he added.

NCC’s Global Head of Threat Intelligence, Matt Hull, predicted that DDoS attacks will likely continue to increase.

“However, as more organizations become aware of the heightened threat, it will be interesting to see how malicious actors using DDoS attacks are countered,” he said in a statement. “DDoS is not a new type of attack, and preventive and defensive measures are more widely available and affordable than ever.”

DDoS not for the ransomware crowd

While denial of service attacks were common with some cybercriminal groups, there has been a reduction in ransomware-related DDoS attacks, McQuiggan noted.

“This action could be the result of the victim organization being prevented from using the Internet to access the Tor network, which would make payment very difficult,” he explained.

“If they’re issuing the denial of service,” he continued, “it’s to let the organization know that they’re still susceptible to further attacks to continue the threat.”

DDoS attacks appear to be less of a concern than data breaches, malware and phishing because DDoS attacks generally do not result in the theft or loss of sensitive data, observed Casey Ellis, CTO and founder of Bugcrowd, an operator of a crowdsourced bug bounty platform.

“While DDoS attacks can significantly disrupt a company’s operations, they do not pose the same level of risk to the confidentiality, integrity, or availability of critical data as other types of cyberattacks,” Ellis told TechNewsWorld. “DDOS attacks are less sophisticated and easier to defend against data breaches, malware and phishing attacks.”