Remote services are becoming an attractive target for ransomware

(Image credit: Future)

Stolen credentials are no longer the number one initial access vector for ransomware operators looking to infect a target network and its endpoints - instead, they’ve become more interested in exploiting vulnerabilities found in internet-facing systems.

A report from Secureworks claims ransomware-as-a-service developers are quick to add newly discovered vulnerabilities into their arsenals, allowing even less competent hackers to exploit them swiftly, and with relative ease.

In fact, the company's annual State of the Threat Report reveals that flaw exploitation in remote services accounted for 52% of all ransomware incidents the company analyzed over the last 12 months.

Biggest threat to businesses

Besides remote services, Secureworks also spotted a 150% increase in the use of infostealers, which became a “key precursor” to ransomware. Both these factors, the report stresses, kept ransomware as the number one threat for businesses of all sizes, “who must fight to stay abreast of the demands of new vulnerability prioritization and patching”.

All things considered, ransomware is still the biggest threat for businesses. It takes up almost a quarter of all attacks that were reported in the last 12 months, Secureworks says, and despite law enforcement being actively involved, operators remained highly active.

> What is ransomware and how does it work?

> This new Royal ransomware is already asking for millions

> These are the best servers for small businesses right now

This year, on average, it took a company four and a half days to spot a ransomware attack, down from five days last year. Mean dwell time was cut in half, though, from 22 days in 2021, to 11 days this year. Victims have roughly a week to respond and mitigate any potential damage, Secureworks added.

The number of compromised companies, whose names ended up on the hackers’ leak sites remains high, growing from 1,170 in the first six months of 2021, to 1,307 for the same period this year.

The company listed GOLD MYSTIC as one of its biggest offenders. This is a group that uses LockBit and was adding an average of 70 victim names a month to its leak site, since July 2021.

Here's our rundown of the best malware protection tools right now

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.