2021 Cybercrime Report: Three Top Ransomware Variants Maintain Strong Momentum

In the past year of 2021, global cyber attacks and malicious cyber activities increased unpredictably, which extensively compromised various organizations and enterprises in both public and commercial sectors. The US Internet Crime Complaint Center (IC3) recently released the 2021 Internet Crime Report, in which ransomware, Business Email Compromise (BEC), and the illicit use of cryptocurrency were the main events in the report. The BEC schemes alone generated up to $2.4 billion in direct losses.

▌Business Email Compromise (BEC)

BEC is a sophisticated scam targeting businesses to facilitate funds transfers, in which attackers compromise legitimate business email accounts through social engineering or computer intrusion techniques to conduct unauthorized fund transfers.

As attackers become more sophisticated and preventive measures are put in place, BEC schemes continue to evolve. The scheme evolved from simple hacking of email accounts and sending wire payment requests to fraudulent accounts. Historically, these schemes involved compromised vendor emails, requests for W-2 information, and scams targeting the real estate sector and large volumes of gift cards.

Now, scammers are starting to use virtual meeting platforms to compromise emails and steal credentials of corporate managers to initiate fraudulent wire transfers. These fraudulent wire transfers are usually immediately transferred to cryptocurrency wallets and rapidly dispersed, making recovery efforts more difficult.

The global pandemic has led to an increase in remote work or virtual communications, and in 2021, IC3 observed the emergence of newer BEC schemes that exploit this reliance on virtual meetings to instruct victims to send fraudulent wire transfers.

By compromising the email of the CEO or CFO, they utilize email to request employees to join a virtual meeting platform. Scammers insert a static photo of the CEO without audio in the meeting, or insert "deep fake" audio. The criminal masquerading as a corporate executive will claim that their audio/video is not working properly, and then use the virtual meeting platform to directly instruct the employee to initiate a wire transfer, or use the executive's compromised email to provide wire transfer instructions.

▌Ransomware

In 2021, IC3 recorded ransomware losses of over $49.2 million. Cybercriminals use data as leverage to threaten victims to pay ransoms. If the victim refuses to pay, the criminals usually destroy or publish the data.

In 2021, ransomware tactics and techniques became increasingly sophisticated, and the threat of extortion to global organizations grew significantly. Phishing emails, Remote Desktop Protocol (RDP) exploits, and software vulnerability exploits were the top three initial infection vectors for ransomware incidents. Once attackers gain code execution on a device or network access, they can deploy ransomware.

Notably, these infection vectors are likely to remain popular because the increased use of remote work and remote education has expanded the remote attack surface, making it difficult for cyber defense teams to keep pace with routine software patching.

The primary victims of ransomware also include critical infrastructure sectors that are vital, and once attacked, can have devastating impacts on public safety, the national economy, and public health. Among the known ransomware variants reported by IC3, the top three variants attacking critical infrastructure sectors are CONTI, LockBit, and REvil/Sodinokibi.

According to IC3, CONTI most commonly compromises critical manufacturing, commercial facilities, as well as food and agriculture sectors. LockBit most commonly attacks government facilities, healthcare, public health, and financial services sectors. The main targets of REvil/Sodinokibi are the financial services, information technology, healthcare, and public health sectors.

Among all critical infrastructure sectors affected by ransomware in 2021, the healthcare and public health, financial services, and information technology sectors were the most common victim sectors. IC3 expects attacked critical infrastructure to increase in 2022.

▌Recommended Preventive Measures

• Update operating systems and software

• Conduct user training and phishing exercises to raise awareness and prevention of risks associated with suspicious links and attachments

• Secure and monitor Remote Desktop Protocol (RDP)

• Backup data offline

• Verify the effectiveness of the defense system

The Security Metric Validation Platform of Pygostylia can recreate a series of cyber fraud attacks such as phishing emails containing malicious links or attachments, and attackers utilizing email compromise to collect information, providing enterprises with secure defense system effectiveness validation services.

You can easily select validation experiments for phishing emails containing malicious links or attachments in the Pygostylia Security Metric Validation Platform, designating controlled clients to send these emails to specified email addresses in the enterprise email system, to verify whether your enterprise's email security products have the capability to detect these phishing emails and isolate or delete them.

Pygostylia Validation will also continuously update malicious attachments and malicious links in the email validation experiments to enable you to continuously verify the protection capabilities of your email security products against such emails.

Similarly, you can also continuously run the ransomware validation scenarios provided by the Pygostylia Security Metric Validation Platform, which contain different attack methods based on different attack stages of ransomware, including reconnaissance, initial access, malicious DNS requests, C&C callback, information gathering, lateral movement, data upload, malicious file delivery, ransomware execution, etc.

These stages contain all types of ransomware behaviors collected by the Pygostylia Validation Security Lab, perfectly simulating all attack methods and malicious samples of different ransomware on a one-to-one basis. Ultimately, it can continuously verify your various security measures in anti-ransomware propagation and anti-ransomware execution, ensuring they can continuously maintain a high level of defense capability. At the same time, it also allows the incident response team to respond to, trace, and analyze these simulated attacks, ensuring that their response processes are correct, and exercising their tracing and analytical capabilities, so as to properly handle similar incidents that may occur in the future.

| References

https://www.ic3.gov/Media/PDF/AnnualReport/2021_IC3Report.pdf