Microsoft recently disclosed that they are monitoring over 100 different threat actors utilizing 50 unique ransomware families to attack businesses and organizations across the world. These attacks have been increasing in frequency, severity, and sophistication. The threat actors behind them are using a range of techniques to gain access to their targets, including exploiting unpatched software vulnerabilities, phishing attacks, and brute-force attacks against remote desktop protocol (RDP) endpoints.

In response to this growing threat, Microsoft suggests that defensive strategies should concentrate less on the payload and more on the sequence of events that lead to the ransomware’s deployment. Despite there being an overwhelming number of ransomware families at any given time, most threat actors employ the same tactics when carrying out their attacks, which go beyond phishing. Threat actors target servers and devices that have not yet deployed patches against common or recently known vulnerabilities, which is why swiftly patching vulnerabilities is crucial in preventing ransomware attacks.

Recently, Microsoft advised administrators to deploy the most recent Cumulative Update (CU) to secure on-premise Exchange servers and instructed users to remain prepared to install emergency security updates. More than 60K internet-exposed Exchange servers remain susceptible to attacks that take advantage of ProxyNotShell RCE exploits, while thousands of others still need protection from attacks targeting ProxyShell and ProxyLogon vulnerabilities, which were two of 2021’s most frequently exploited security flaws.

It is important to note that despite the number of attacks remaining steady, ransomware gangs’ income dropped by around 40% in 2022, as victims refused to pay ransom demands. While this is good news, it is important for businesses to remain vigilant and take steps to protect themselves against ransomware attacks. This includes regularly updating software, implementing strong passwords and multi-factor authentication, regularly backing up data and testing backups, and staying aware of new security vulnerabilities.

You can read more about this story at Bleeping Computer.

Click HERE to more about Alvaka’s Ransomware Prevention Services! We are available 24×7, 365 days a year, to assist you with any of your ransomware needs.

Latest Ransomware Related Blogs

Securing data backups against ransomware. The image depicts a cybersecurity theme with a focus on data protection. In the foreground, hands are typing on a laptop keyboard, symbolizing user interaction with technology. Floating above the laptop is a large, glowing white padlock icon, representing secure access or cybersecurity. To the left of the padlock are three smaller icons: a cloud with arrows (representing cloud storage or data transfer), a shield with a checkmark (indicating security or protection), and a globe with an envelope (symbolizing global communication or email security). On the right side of the padlock is a semi-transparent login interface displaying "CYBER SECURITY" with placeholders for a username and password, emphasizing secure user authentication. The background is softly blurred, focusing attention on the icons and laptop interaction. The overall tone conveys the importance of cybersecurity in a connected digital environment.
Incident Response Readiness. The image shows a man sitting at a desk, visibly stressed, with his hands on his head. He is staring at two computer monitors displaying warning messages that read "SYSTEM HACKED," suggesting that his computer system has been compromised. The room appears to be an office setting, with a light background and organized desk supplies. The man seems overwhelmed, likely due to the cyberattack that has disrupted his work.
Canva image. The image shows a close-up of a document labeled "Impact Analysis" with the phrase "Work products to be modified" underneath. A sharpened pencil is positioned diagonally on the document, emphasizing the text. The image suggests an analysis or evaluation process, with the pencil symbolizing planning or marking important points. The context appears to involve reviewing or modifying work processes or products based on the impact analysis findings.
Mitigating DoppelPaymer ransomware effects. The image depicts a person typing on a keyboard, with a digital overlay of cybersecurity elements. There is a semi-transparent shield icon with a padlock in the center, symbolizing security, and other icons related to data protection and technology around it. On the right side, there’s a digital login form interface, showing fields for a username and password. The overall theme of the image appears to be related to cybersecurity and secure online access. The person in the image is wearing a blue shirt, though their face is not visible.
Ransomware Rescue
Contact Alvaka