The year 2021 was a total highlight for ransomware attack cases as it wreaked havoc on individuals and organizations around the world when it comes to Cybersecurity. It is a trend that will continue into 2022 and beyond.
While ransomware is not new to Cybersecurity, it is a threat that has received attention at the highest levels of government and business.
The threat has affected people’s ability to get medical care, put gas in their vehicles, and buy groceries, among other impacts.
The financial effects of a ransomware attack also became prominent during 2021. The impacts hit supply chains, causing more widespread damage than an attack against a single individual.
There has also been an increased response from government and technology vendors to help stem the tide of ransomware attacks.
Anatomy of a ransomware attack in 2021 and 2022
We haven’t even finished the first quarter of 2022 and ransomware attacks are already catching our attention. Companies such as Americanas, Submarino, Shoptime, Samsung, NVidia, and Mercado Livre have recorded Cybersecurity incidents that were probably triggered by ransomware attacks and phishing scams.
The anatomy of attacks that occurred throughout 2021, and will likely continue into 2022, indicates that cybercriminals have realized that certain techniques produce better results and are focusing on those approaches.
Let’s look at some of the main attack characteristics.
Supply Chain Attacks
Instead of attacking a single victim, the supply chain attacks have extended the blast radius. An excellent example of a ransomware attack in 2021 is the Kaseya attack, which affected at least 1,500 of its managed service provider customers.
Double Extortion
In the past, ransomware was about attackers encrypting information found on a system and demanding a ransom in exchange for a decryption key.
With double extortion, the attackers also export the data to a separate location. There, it can be used for other purposes, including leaking the information to a public website if payment is not received.
Ransomware as a Service (RaaS)
In Cybersecurity, gone are the days when every attacker needed to write their own ransomware code and perform a unique set of activities. RaaS is pay-per-use malware.
It allows attackers to use a platform that provides the code and operational infrastructure necessary to launch and maintain a ransomware campaign.
Attack unpatched systems
This was not a new trend for 2021, but it remains a problem year after year. Although there are ransomware attacks that use new zero-day vulnerabilities (
Zero Day
), most continue to abuse known vulnerabilities in unpatched systems.
Phishing Scams
Although ransomware attacks can infect organizations in different ways, in 2021, some form of phishing email was the primary cause.
How to invest in Cybersecurity and prepare for ransomware attacks
Perhaps one of the most important cybersecurity lessons to be learned from the past few years is the importance of advanced preparation for potentially disruptive incidents, such as phishing or ransomware attacks.
A wave of social engineering coups followed as the global health crisis spread around the world, striking at the fears and discomfort of workers during this uncertain period.
While many of the phishing and ransomware controls are already in place today, there are important steps that security administrators should take to prevent and address a potential attack.
Daily Cybersecurity checks for phishing and ransomware
During business activities the main ways to prepare for phishing, ransomware and other cyber attacks include the following:
- Secure the network perimeter and mitigate any potential breaches to prevent malware from entering the organization;
- Analyze intrusion attempts and make adjustments to perimeter protection as needed;
- Ensure that network perimeter Cybersecurity equipment, including firewalls, intrusion detection and prevention systems, DMZs, and security analysis systems and software are up to date with current configurations and rules;
- Regularly monitor performance metrics, such as average detection time and average repair time, to ensure that incidents are managed effectively;
- Test and verify cybersecurity management systems and software can be accessed and managed remotely;
- Perform regular updating of safety equipment rules and other parameters;
- Install and test all relevant patches;
- Review and update cybersecurity policies and procedures as needed, especially for phishing and ransomware incidents;
- Train cyber security team members on all security mitigation features, procedures, and policies.
Investment in Cybersecurity goes beyond critical global events
The COVID-19 pandemic and other global events, such as Russia’s current war against Ukraine, affect thousands of companies and millions of people around the world.
While the long-term implications have yet to be determined, for cyber security professionals, the need for increased due diligence is key.
With people working remotely and focusing on global issues, cybercriminals are likely to be more aggressive.
In future similar events, the need for proactive Cybersecurity management will be an essential business requirement.
CipherTrust Transparent Encryption: Real-Time Protection Against Any Type of Ransomware Attack
CipherTrust Transparent Encryption is a file system-level encryption solution that leverages the encryption and key management capabilities of the CipherTrust Manger platform to protect against any type of Ransomware attack.
Filesystem-level encryption is a form of disk encryption in which individual files or directories are encrypted by the system itself. The CipherTrust Transparent Encryption solution performs transparent encryption.
In practice, authorized users continue to have read and write access to the encrypted data, while unauthorized users cannot access the encrypted data. As the main characteristics of the solution, we can highlight:
- Centralized key and policy management to meet compliance requirements;
- Performs transparent encryption of server data at rest without interrupting business operations or application performance;
- Granular access controls so that unauthorized users and processes cannot access the encrypted data;
- It can be deployed on network shares, file, web, application, database servers, or other machines running compatible software.
Deployment is simple, scalable, and fast, with agents installed on the operating file system or device layer, and encryption and decryption are transparent to all applications running above it.
CipherTrust Transparent Encryption is designed to meet data security compliance requirements and best practices with minimal disruption, effort, and cost. Critical to combating the Ransomware attack.
Implementation is seamless, keeping business and operational processes running smoothly, even during deployment and launch.
About EVAL
With a track record of leadership and innovation dating back to 2004, Eval not only keeps up with technological trends, but we are also in an incessant quest to bring news by offering solutions and services that make a difference to people’s lives.
With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.
Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.
Eval, safety is value.
