Spike in ransomware attacks, keep security teams on high alert

TLDR:

Key Points:

• Ransomware attacks have plateaued, but security teams are still at risk for more pain.
• Compromised credentials are a major root cause of attacks, with organizations neglecting good authentication practices.

In the first half of 2024, Sophos’ X-Ops team analyzed over 150 incident response cases to provide insights into current attacker tactics. While ransomware attacks have plateaued, they still remain prevalent, with leading strains including LockBit and Akira. Compromised credentials are a major issue, with 56% of cases involving this root cause, and 43% of organizations still not implementing multifactor authentication.

Furthermore, data exfiltration occurred in 40% of cases, with an acceleration in ransomware payload detonation times. Lateral movement trends show rampant RDP abuse and the use of LOLBins like PowerShell. Defender mistakes, such as missing logs and lack of MFA, are preventing effective defense. The report stresses the importance of basic security hygiene, such as patching vulnerabilities and enforcing MFA, to prevent attacks.

While the current threat landscape may seem calm, security teams must prioritize basic security practices to bolster defenses and prepare for impending attacks.