article thumbnail

Ransomware world in 2021: who, how and why

SecureList

They interact with each other through internet handles, paying for services with cryptocurrency. Hackers who are on the lookout for publicly disclosed vulnerabilities (1-days) in internet facing software, such as VPN appliances or email gateways. Access sellers. Idea #3: Cybercriminals are criminals.

article thumbnail

Ransomware by the numbers: Reassessing the threat’s global impact

SecureList

In certain cases, they used spear-phishing campaigns to install Cobalt Strike RAT, while other attacks involved exploiting a vulnerable internet-facing service (e.g., Citrix ADC/NetScaler or Pulse Secure VPN) or weak RDP credentials to breach the network. Maze primarily targeted businesses and large organizations. Conclusion.

article thumbnail

Evolution of JSWorm ransomware

SecureList

Energy and Utilities (10%), Finance (10%), Professional and Consumer Services (10%), Transportation (7%), and Healthcare (7%) were also at the top of their list. Focus your defense strategy on detecting lateral movements and data exfiltration to the internet. Conclusion. Always keep client-side applications up to date as well.