3 common initial attack vectors account for most ransomware campaigns

Most ransomware attackers use one of three main vectors to compromise networks and gain access to organizations’ critical systems and data.

The most significant vector in successful ransomware attacks in 2022, for example, involved the exploitation of public-facing applications, which accounted for 43% of all breaches, followed by the use of compromised accounts (24%) and malicious email (12%), according to Kaspersky’s recently released report, “The Nature of Cyber Incidents.”

Both exploitation of applications and malicious emails declined as a share of all attacks compared with the previous year, while the use of compromised accounts increased from 18% in 2021.

Bottom line: Doubling down on the most common attack vectors can go a long way to preventing a ransomware attack. “A lot of companies are not the initial targets for attackers but have weak IT security and [allowing them to] be hacked easily, so cybercriminals take the opportunity,” says Konstantin Sapronov, head of the global emergency response team at Kaspersky. “If we look at top three initial vectors, which together account for almost 80% of all cases, we can implement some defensive measures to mitigate them, and go a very long way to decreasing the likelihood of becoming a victim.”

The top initial vectors cited by Kaspersky match an earlier report by incident-response firm Google Mandiant, which found that the same common vectors made up the top three techniques — exploitation of vulnerabilities (32%), phishing (22%), and stolen credentials (14%) — but that ransomware actors tended to focus on exploitation and stolen credentials, which together accounted for nearly half (48%) of all ransomware cases.

Ransomware took off in 2020 and 2021, but leveled off last year — even dropping slightly. But this year, ransomware and a related attack — data leaks with a goal of collecting a ransom — appear to be increasing, with the number of organizations posted to data leak sites increasing in the first part of 2023, says Jeremy Kennelly, lead analyst for financial crime analysis at Mandiant.

“This may be an early warning that the respite we saw in 2022 will be short-lived,” he says, adding that the ability to continue to use the same initial access vectors has helped attacks.

“Actors engaging in ransomware operations haven’t needed to evolve their tactics, techniques, and procedures (TTPs) significantly in recent years, as well understood strategies have continued to prove effective,” Kennelly says.

To read the complete article, visit Dark Reading.