Cyber Defense eMagazine March Edition for 2022

servers, databases, websites, and systems updated with the latest patches to limit vulnerabilities
for attackers to exploit.
• Ransomware, Ransomware, Ransomware – After a steep decline in 2020, ransomware attacks
reached 105% of 2020 volume by the end of September (as WatchGuard predicted at the end of
the prior quarter) and are on pace to reach 150% once the full year of 2021 data is analyzed.
Ransomware-as-a-service operations such as REvil and GandCrap continue to lower the bar for
criminals with little or no coding skills, providing the infrastructure and the malware payloads to
carry out attacks globally in return for a percentage of the ransom.
• The quarter’s top security incident, Kaseya, was another demonstration of the ongoing
threat of digital supply chain attacks – Just before the start of the long 4 th of July holiday
weekend in the US, dozens of organizations began reporting ransomware attacks against their
endpoints. WatchGuard’s incident analysis described how attackers working with the REvil
ransomware-as-a-service (RaaS) operation had exploited three zero-day vulnerabilities (including
CVE-2021-30116 and CVE-2021-30118) in Kaseya VSA Remote Monitoring and Management
(RMM) software to deliver ransomware to some 1,500 organizations and potentially millions of
endpoints. While the FBI eventually compromised REvil’s servers and obtained the decryption
key a few months later, the attack provided yet another stark reminder of the need for
organizations to proactively take steps like adopting zero-trust, employing the principle of least
privilege for vendor access and ensuring systems are patched and up to date to minimize the
impact of supply chain attacks.
In Q3, malware per device skyrocketed and was up for the first time since the pandemic began. Looking
at 2021, it’s clear cybersecurity continues to challenge users. Its critical organizations think about the
long-term ups and downs as well as focus on persistent, concerning trends factoring into their security
posture. A strong cybersecurity strategy includes endpoint protection, multi-factor authentication and
secure Wi-Fi – all important components in a layered approach to security. When implemented properly,
users can drastically mitigate outsider threats.
About the Author
Corey Nachreiner is the CSO of WatchGuard Technologies. A front-line
cybersecurity expert for nearly two decades, Corey regularly contributes
to security publications and speaks internationally at leading industry
trade shows like RSA. He has written thousands of security alerts and
educational articles and is the primary contributor to the Secplicity
Community, which provides daily videos and content on the latest security
threats, news and best practices. A Certified Information Systems
Security Professional (CISSP), Corey enjoys "modding" any technical
gizmo he can get his hands on and considers himself a hacker in the old
sense of the word. Corey can be reached at @SecAdept on Twitter or via
https://www.watchguard.com.
Cyber Defense eMagazine – March 2022 Edition 38
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.