By Juliet Umeh
Next-generation cybersecurity company Sophos has revealed the pattern cyber attackers will adopt to rampage and go corporate IN 2021.
According to the company, the report provides a three-dimensional perspective that includes the gap between ransomware operators at different skill extremes and the spectrum of resources will increase.
It read: “At the high end, big-game ransomware families will continue to refine and change their tactics, techniques and procedures (TTP) to become more evasive and sophisticated like that of a nation-state, targeting larger organizations with millions of demands. dollar ransom. In 2020, these families included Ryuk and RagnarLocker. “
At the other end of the spectrum, Sophos anticipates an increase in the number of entry-level, apprentice-type attackers looking for menu-based rental ransomware, such as Dharma, that allows them to target large volumes of smaller prey.
Another ransomware trend is “secondary extortion,” in which, along with data encryption, attackers steal and threaten to release sensitive or confidential information if their demands are not met. In 2020, Sophos reported on Maze, RagnarLocker, Netwalker, REvil, and others using this approach.
“The ransomware business model is dynamic and complex. During 2020, Sophos saw a clear trend for adversaries to differentiate themselves in terms of their skills and goals.
The company’s principal research scientist, Chester Wisniewski, said: “We have also seen families of ransomware that share the best tools and form collaborative ‘cartels’ in their own style. “Some, like Maze, seemed to pack their bags and go into a life of leisure, except that some of their tools and techniques have resurfaced in the guise of a newcomer, Egregor.
The cyber threat landscape abhors a vacuum. If one threat disappears, another will quickly take its place. In many ways, it is nearly impossible to predict where the next ransomware will go, but the attack trends discussed in this year’s Sophos threat report are likely to continue into 2021. “
On another dimension, the company said that everyday threats like commodity malware, including loaders and botnets, or human-operated initial access agents, will demand serious security attention.
It read: “Such threats may sound like low-level malware noise, but they are designed to secure a foothold on a target, collect essential data, and share data with a command-and-control network that will provide further instructions.
If human operators are behind these types of threats, they will review each compromised machine for its geolocation and other high-value signs, and then sell access to the most lucrative targets to the highest bidder, such as a major ransomware operation. For example, in 2020, Ryuk used the Buer Loader to deliver his ransomware.
Furthermore, he noted that in the latter dimension, “All ranks of adversaries will increasingly abuse legitimate tools, recognized public services, and common network destinations to evade detection and security measures and thwart analysis and attribution.
The abuse of legitimate tools allows adversaries to stay under the radar as they move around the network until they are ready to launch the main part of the attack, such as ransomware. For attackers sponsored by nation states, there is the added benefit that using common tools makes attribution difficult.
