CS Mar-Apr 2024

ansomware
NEW THREAT ACTORS SEND RANSOMWARE ATTACKS SOARING
SOPHISTICATED ATTACK METHODS SURFACE, WITH HEALTHCARE BECOMING A PROMINENT TARGET
In December last year, global levels of
ransomware attacks fell by 12% from
November, with a total of 391 cases,
compared to 442 in the previous month,
according to NCC Group's December Threat
Pulse. Good news? Not really. The figure
for December took the total number of
ransomware attacks in 2023 to 4,667 -
far beyond NCC Group's initial expectations
that cases would hit 4,000. The annual total
marks an 84% increase from all recorded
ransomware attacks in 2022.
Despite the usual threat groups responsible
for ransomware attacks, December 2023
saw three new groups enter the top ten most
active. Data reveals that newcomer Hunters
ranked in fifth place with 22 cases (6% of
total). The group is believed to be a rebrand of
Hive, dismantled by Europol and the FBI earlier
in 2023. DragonForce ranked in sixth spot,
responsible for 21 cases (5%), and has been
active since Summer 2022. WereWolves also
joined the ranking in tenth spot, with
speculation that they are a LockBit affiliate.
North America and Europe remained the
two most targeted regions in December, with
80% of global attacks between them. North
America experienced 51% (199) of all attacks,
down from 219 in November, with 114
attacks in Europe marking a 29% regional
reduction in cases. Claiming third place,
Asia witnessed 37 attacks, also representing
a decrease of 20%.
Most notably, the data also reveals that
attacks in Russia rose in December to 12
cases, accounting for 11% of all attacks levied
against targets in Europe, compared to the
whole of 2023.
Despite healthcare not placing in the top
three most targeted sectors, it is now regarded
as frequently at risk of ransomware attacks.
Following October and November, where it
was in the top three most targeted sectors,
the total volume of ransomware attacks on
healthcare in 2023 has resulted in it being
considered at similar risk to other sectors.
INCREASED ACTIVITY
OF MALWARE FAMILIES
In December, malware families (a group of
applications with similar attack techniques)
were more active than previous months. Two
malware families, Hydra mobile malware and
the unexpected activity of Qakbot, following
the malware family's infrastructure take-down
at the end of August, were notable.
The infostealer Meduza Stealer also
resurfaced in December, with a new version
to help cybercriminals make their attacks
more sophisticated through methods such
as accounts takeover (ATO), online-banking
theft and financial fraud. The re-emergence
of significant malware families helps attackers
to develop their own methods of gathering
intelligence and understanding vulnerabilities,
to prepare for the delivery of ransomware to
their victims.
Matt Hull, global head of threat intelligence
at NCC Group, comments: ""Closing 2023
with over 4,000 global ransomware attacks is
reflective of the sharp rise of cyber-criminal
activity, compared with 2022. Over the year
we've seen the development of sophisticated
attack methods, allowing both new and old
threat groups to exploit vulnerabilities of
victims across a range of sectors and, in particular,
present threats to healthcare where we've
seen notable successful attacks over the last
12 months, with vast volumes of data being
compromised."
Matt Hull, NCC Group: sharp rise seen
in cyber-criminal activity in 2023.
www.computingsecurity.co.uk @CSMagAndAwards March/April 2024 computing security
29