4 Types of Ransomware Attacks That Will Sabotage Your Enterprise

Threat report: This Russian-led ransomware gang was responsible for several high-profile ransomware attacks, including the Colonial Pipeline attack and the attack on JBS Foods, and the Kaseya data breach⁷. The US Department of Justice indicted the group⁸ for cybercrimes following these attacks and the alleged theft of $6 million from a cryptocurrency exchange. The REvil ransomware gang's tactics⁹ include breaking into networks, exfiltrating data and even deleting and disabling data backup and recovery systems so companies are forced to pay ransom if they want to stay in business. It can even inject itself into the host’s processes to impact operations. While several members of the REVil’s ransomware gang were arrested in January, the ransomware itself still poses a threat.

Threat Report: The Conti ransomware gang uses ransomware-as-a-service, meaning it pays other cybercriminals to gain access to networks primarily through malicious email attachments, stolen Remote Desktop Protocol (RDP) credentials, fake software advertised online and other means¹⁰, according to the Cybersecurity & Infrastructure Security Agency (CISA).

This Russian-based group has attacked more than 400 organizations worldwide¹¹. It recently exploited the Log4Shell vulnerability¹² to gain access to servers that would have otherwise been protected. Once the ransomware attackers gain access, they steal and encrypt sensitive data, demand ransom to decrypt it and also threaten to publicly release the data — known as double extortion. Conti ransomware can also infect other machines through shared drives and stop email, security and backup services.

Threat report: LockBit, formerly known as “ABCD ransomware” for the file extension name it uses to encrypt files¹³, is another ransomware-as-a-service gang believed to be six times more active than Conti and much faster at data encryption compared to other groups¹⁴. The group recruits experienced penetration testers and sends them a cut of each ransomware payment. When a victim refuses to pay, LockBit steals their files and uploads their data to their own blog on the dark web.

Cybersecurity expert Kaspersky and others believe it’s part of a larger family of attackers known as LockerGoga & MegaCortex. According to Kaspersky, its attacks are “self-spreading and targeted, using tools like Windows Powershell and Server Message Block to spread.”

Threat report: One common malware attack technique is to destroy data to interrupt critical services or business operations. MITRE lists many different tactics for malicious data destruction¹⁵, including destroying files and folders, making deleted files unable to be recovered, and overwriting files.

A Carbon Black report shared in HIPAA Journal found 45% of healthcare organizations had experienced a ransomware attack that focused on data destruction in 2019.