The report revealed a 4.5% increase in ransomware-related Common Vulnerabilities and Exposures (CVEs) and a 3.4% increase in ransomware families compared to Q2 2021
Ivanti Inc., provider of the Ivanti Neurons automation platform that discovers, manages, protects and supports IT assets from the cloud to the edge, presents the results of the Q3 2021 Ransomware Index Spotlights Report conducted with Cyber Security Works and Cyware, a leading provider of Cyber Fusion, next-generation SOAR and threat intelligence solutions. The report revealed a steady growth of ransomware clusters in terms of accuracy, threat, and volume, with numbers increasing starting in Q2 2021. The latest quarter highlighted a 4.5% increase in ransomware-related CVEs, a 4.5% growth in trends and actively exploited vulnerabilities, a 3.4% increase in existing ransomware families, and a 1.2% increase in old ransomware-related vulnerabilities compared to the previous quarter. Q2 2021.
The analysis found 12 new ransomware-related vulnerabilities in Q3 2021, bringing the number of cases associated with this type of attack to 278. Among these, five of them are capable of carrying out remote code attacks and two can exploit web applications and be manipulated to launch denial-of-service attacks. The report also noted how ransomware groups continue to identify and exploit zero-day vulnerabilities, anticipating the addition of CVEs to the National Vulnerability Database and the release of patches. The REvil group, for example, discovered and exploited a vulnerability in Kaseya VSA software while the company's security team was actively working on a patch.
The report also highlights six new active and trending ransomware vulnerabilities, bringing the total to 140, and five new ransomware families, for a total of 151. These new groups quickly exploited some of the most dangerous vulnerabilities to date, such as PrintNightmare, PetitPotam and ProxyShell, in Q3. The techniques used by these types of attacks are dropper-as-a-service and trojan-as-a-service respectively. The first allows less experienced cybercriminals to distribute malware through programs that, if launched, can execute a malicious payload on the victim's computer. The second, also called malware-as-a-service, allows anyone with an Internet connection to obtain and spread custom malware in the cloud, without installation.
Additionally, the report found that three vulnerabilities dating back to 2020 were again exploited by ransomware in Q3 2021, bringing the total to 258, or 92.4% of all ransomware-related vulnerabilities. In Q3, ransowmare group Cring identified two previously known vulnerabilities, CVE-2009-3960 and CVE-2010-2861, which have been patched for more than a decade.
Srinivas Mukkamala, Senior Vice President of Security Products at Ivanti said, "Ransomware groups continue to refine their tactics, expand their attack tools, and target unpatched vulnerabilities across enterprise attack surfaces. With this report, we aim to raise security awareness among organizations about the risk to their endpoints and their environment, giving them the information they need to timely remediate threats. Organizations must take a proactive, risk-based approach to managing patches by leveraging automation technologies and reducing mean time to detection, discover, remediate and respond to ransomware attacks.”
Anuj Goel, CEO di Cyware commented: "This research highlights how ransomware continues to evolve, becoming increasingly dangerous and causing irreversible damage to target organizations. What is more complex for many organizations is the inability of industry verticals to quickly share specific IOCs, aimed at facilitating coordination, automatic task management and preventive execution even before an attack occurs. Managing organizational risk means that companies should aim for a collective defense strategy with complete visibility into attack and risk surfaces, reducing enormous losses of reputation, customers and Finances By responding effectively and promptly to ransomware, IT teams can leverage IT automation and processes.”
Aaron Sandeen, CEO di Cyber Security Works, he said, "In addition to the increased volume and precision of these attacks, we also saw increased cybersecurity maturity among our customers in Q3. Together we were able to reduce their risks by continuously assessing vulnerabilities and integrating our insights into their daily operations, reducing the time to respond and implement corrective actions."
The Ransomware Index Spotlight Report is based on data collected from multiple sources, including those owned by Ivanti and CSW, public threat databases, cyber attack researchers, and penetration teams. To read the complete report go to the following link.
