Manufacturing companies are the most likely targets of double-extortion ransomware attacks, according to a report from research team ThreatLabZ this week.
In a double-extortion attack, criminals not only encrypt data but steal it too, enabling them to blackmail victims into preventing its publication. ThreatLabZ, ZScaler's research team, noted that 12.7% of the companies affected by these attacks were in the manufacturing sector, followed by services companies. This stood out from a cluster of other sectors who each accounted for between 8 and 9% of attacks: services, transportation, retail, and technology. This report follows a previous study that found a 300% increase in cyber attacks on manufacturing organizations.
ThreatLabZ identified seven ransomware families that stood out as sources of double-extortion attacks. The most common was Maze, which accounted for 273 attacks in the last year. Even though Maze ceased operations in November 2020, it still outpaced the Conti ransomware, which took second place with 190 attacks.
The Ragnar Locker ransomware, which sets up a virtual machine on its target machine, focused the most on the manufacturing sector, with 22% of its attacks hitting those companies.
Doppelpaymer was also focused on manufacturing, targeting manufacturers in 15.1% of its incidents.
Manufacturing was also Conti's top target, attracting 12.4% of its attacks, while Sodinokibi/REvil featured manufacturing and transportation equally as its top target sectors.
ThreatLabz also examined DarkSide, which is of particular interest this week after its use in the Colonial Pipeline attack. The group, which clarified its motives for hitting the pipeline this week, focused only 2.8% of its attacks on the oil and gas sector. Services was its go-to sector, accounting for 16.7% of attacks.
Anti-ransomware company Coveware highlighted a rise in double-extortion attacks in its most recent Q1 ransomware research, which reported that 77% of attacks now featured this tactic, up 10% from Q4 2020.
-
The unseen risk in Microsoft 365: disaster recoveryBusinesses that assume they’re covered for data backup could come unstuck in a time of crisis
-
Anthropic CEO Dario Amodei's prediction about AI in software development is nowhere nearly to becoming a realityNews In March, Anthropic CEO Dario Amodei claimed up to 90% of code would be written by AI within six months – his prediction hasn't quite come to fruition.
-
Prolific ransomware operator added to Europe’s Most Wanted list as US dangles $10 million rewardNews The US Department of Justice is offering a reward of up to $10 million for information leading to the arrest of Volodymyr Viktorovych Tymoshchuk, an alleged ransomware criminal.
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attackNews The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalitiesNews The attack on IT systems supplier Miljödata has impacted public sector services across the country
-
A notorious hacker group is ramping up cloud-based ransomware attacksNews The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b modelNews Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
