Woburn, MA – May 12, 2023 — A new Kaspersky Incident Response Analyst report, ‘The nature of cyber incidents,’ highlights that the majority of ransomware attacks in 2022 started with exploitation of public-facing applications (43%), data from compromised user accounts (24%) and malicious emails (12%).Researchers believe the goal of these attacks was not extortion or data encryption, but to mine personal data, intellectual property, and other sensitive information.

According to the IT Security Economics report, more than 40% of companies faced at least one ransomware attack in 2022 and that SMBs spent an average of $6,500, whilst enterprises paid out 98,000$ for the recovery. These figures reveal that ransomware attacks are still widespread and can hit any company at any time.

Understanding the top three ransomware attack vectors allows researchers to deep dive into attackers strategies for leveraging them. In most of these cases, known credentials had already been compromised and there were no artefacts left to analyze by the time the crime was discovered due to log rotation policies, so it was not possible to investigate how this data was leaked.

The report also revealed that the longest-running ransomware attacks began with the exploitation of public-facing applications, with just over 2 percent of them lasting for a year and more.

“Continuing security issues with passwords, software vulnerabilities and social engineering become initial access vectors for attackers and provides endless ways to perpetrate ransomware activities,” said Konstantin Sapronov, head of global emergency response team at Kaspersky. “To minimize the potential for such activities, it’s important for businesses to set up and control a password policy, patch management, raise employee awareness and take regular anti-phishing measures.”

To read the full Incident Response Analyst report, please visit Securelist.

To protect businesses from possible ransomware threats, Kaspersky experts recommend:

• Make regular system backups and, if possible, keep saved data on devices not connected to the corporate IT network. That will keep information safe if the entire network is compromised.
• Run an update on OS or business software to provide critical security updates, as well as features that may make the work easier.
• Use strong passwords to access corporate services and multi-factor authentication to access remote services.
• Talk to employees about the variety of cybersecurity threats they might encounter outlining potential threats such as phishing emails, shady websites, or software downloaded from unofficial sources. Consider interactive training and tests like Kaspersky Security Awareness to ensure staff remain vigilant.
• Use services and solutions like Kaspersky Incident Response, Kaspersky Endpoint Detection and Response Expert or Kaspersky Managed Detection and Response to identify and stop the attack on early stages, before cybercriminals can reach their final goals.
• Optimize the use of cybersecurity tools by implementing Extended Detection and Response solutions that collect telemetry from various data sources, including endpoint, network, and cloud data, to offer a comprehensive security outlook, as well as promptly detect and automated respond to existing threats.