article thumbnail

Ransomware world in 2021: who, how and why

SecureList

Hackers who are on the lookout for publicly disclosed vulnerabilities (1-days) in internet facing software, such as VPN appliances or email gateways. Dedicated training courses can help, such as the ones provided in the Kaspersky Automated Security Awareness Platform. Access sellers.

article thumbnail

Evolution of JSWorm ransomware

SecureList

Energy and Utilities (10%), Finance (10%), Professional and Consumer Services (10%), Transportation (7%), and Healthcare (7%) were also at the top of their list. Make sure commercial VPN solutions and other server-side software are always up to date as exploitation of this type of software is a common infection vector for ransomware.

article thumbnail

Ransomware by the numbers: Reassessing the threat’s global impact

SecureList

In certain cases, they used spear-phishing campaigns to install Cobalt Strike RAT, while other attacks involved exploiting a vulnerable internet-facing service (e.g., Citrix ADC/NetScaler or Pulse Secure VPN) or weak RDP credentials to breach the network. Maze primarily targeted businesses and large organizations. Conclusion.