2022 Q1 Ransomware Attack Report | Financial Sector Among Top 5 Targeted Industries, Cybercrime Gangs Deploy New Tactics

In the first quarter of 2022, ransomware groups continued to maintain their core threat position, collaborating with various cybercriminals, such as Initial Access Brokers (IABs), to attack companies worldwide. KELA Cybercrime Intelligence analysed the ransomware group activities in the first quarter and reached the following conclusions:

1. The financial sector entered the top five targeted sectors for ransomware. 40% of the attacks were associated with the cybercrime group LockBit.

2. New tactics of ransomware groups: hiding company names when publishing victims

Despite a decrease in the number of ransomware attacks compared to the fourth quarter of 2021, the monthly number of ransomware attacks still showed a significant upward trend.

▌Mainstream Ransomware Groups

The most active ransomware groups in Q1 were LockBit, Conti, Alphv, Hive, and Karakurt (recently discovered to be an affiliate of Conti).

LockBit replaced Conti as the most active group, disclosing 226 victims in the first quarter. The group targeted a wide range of industries, with the highest number of victims, involving the manufacturing, technology, education, and public sectors. In February this year, internal members of Conti leaked part of the ransomware source code and data, offering a glimpse into its organisational activities and structure. Following the leak, Conti's victim count in March doubled since February. Most of these victims came from the manufacturing, industrial products, professional services, and healthcare industries. Combined with Karakurt, a data extortion group related to Conti, Conti remained the second most active group in the first quarter of 2022. Alphv, also known as Blackcat, became active in December 2021, mainly targeting professional services, consumer and retail, and manufacturing. Investigations show that the group's developers and money launderers have links to the DarkSide and Blackmatter ransomware groups. These groups were also found to attack each other's victims; it is currently unclear whether this is collaboration or coincidence. Recent researchers have also found that the Conti group is creating small, autonomous ransomware groups and collaborating with Alphv, AvosLocker, Hive, and HelloKitty groups.

▌Major Target Industries

The primary target industries of ransomware attackers were manufacturing, industrial products, professional services, and technology. Meanwhile, the financial industry also made it to the top 5 target industries in the first quarter of this year, with the number of victims increasing by 40%. The financial sector was also the only industry among the top 10 to see an increase in the number of victims, with 40% of the attacks in this field initiated by LockBit.

In the first quarter, 41 healthcare organisations were still attacked by ransomware groups, with 34% of these attacks associated with Conti and Karakurt.

▌New Intimidation Tactics

Some ransomware groups used new methods of intimidation, including publishing victims without mentioning the company name. For example, Midas claimed on its website that "a new company" fell victim to them, and if the victim did not pay, Midas would expose their company name in the post.

Other ransomware such as Lorenz and Everest adopted the same approach. In contrast, Conti published hidden blog posts that could only be accessed via specific URLs. Attackers shared links to these posts with victims to intimidate them; if the victims agreed to pay, the posts were never published, but if negotiations failed, their information was made public. Judging from the situation in the first quarter, ransomware groups remain menacing in 2022. For enterprises, efforts should be made to catch ransomware attacks at an early stage in order to deploy ahead of time, speed up response times, and minimise their impact. Security Validation can quickly simulate intrusions on a large scale before ransomware deployment, restoring over 600 ransomware attack methods. Under the premise of ensuring security, it can simulate both the transmission and execution of ransomware, helping you verify whether your defence system can respond correctly to these attack methods.

| Reference Source:

https://ke-la.com/blog/