Ransomware groups continue to evolve their tactics and techniques to deploy file-encrypting malware on compromised systems, notwithstanding law enforcement’s disruptive actions against the cybercrime gangs to prevent them from victimizing additional companies.
“Be it due to law enforcement, infighting amongst groups or people abandoning variants altogether, the RaaS [ransomware-as-a-service] groups dominating the ecosystem at this point in time are completely different than just a few months ago,” Intel 471 researchers said in a report published this month. “Yet, even with the shift in the variants, ransomware incidents as a whole are still on the rise.”
Sweeping law enforcement operations undertaken by government agencies in recent months have brought about rapid shifts in the RaaS landscape and turned the tables on ransomware syndicates like Avaddon, BlackMatter, Cl0p, DarkSide, Egregor, and REvil, forcing the actors to slow down or shut down their businesses altogether.
But just as these variants are fading into obscurity, other up-and-coming groups have stepped in to fill the vacuum. Intel 471’s findings have uncovered a total of 612 ransomware attacks between July to September 2021 that can be attributed to 35 different ransomware variants.
Roughly 60% of the observed infections were tied to four variants alone — topped by LockBit 2.0 (33%), Conti (15.2%), BlackMatter (6.9%), and Hive (6%) — and primarily impacted manufacturing, consumer and industrial products, professional services and consulting, and real estate sectors.
images from Hacker News
Recent Comments