Microsoft has released a new ransomware detection feature for Azure that uses machine learning to spot potential attacks.
'Fusion Detection for Ransomware' will send an alert to customers when it observes actions that are "potentially associated with ransomware activities".
The alerts will inform users of what was detected, and on which device, with the system correlating data from other Azure services, such as Azure Defender, Microsoft Defender for Endpoint, Microsoft Defender for Identity, Microsoft Cloud App Security, and Azure Sentinel scheduled analytics rules.
Once ransomware activities are detected and correlated by the Fusion's machine learning model, a high severity incident with the label "Multiple alerts possibly related to Ransomware activity detected" will be triggered in the customer's Azure Sentinel workspace (shown in the image below).
After an alert has been sent, Microsoft recommends users check the device/host in question to see if its behaviour is "unexpected". If so, the user should treat the machine as "potentially compromised" and take immediate actions, such as isolating the machine from the network, running full anti-virus scans, and investigating the rest of the network for similar signs.
Ransomware has become a lucrative occupation, according to a recent report from Unit 42, with average payouts almost doubling over the past year. Since 2020, payouts for successful ransomware attacks have increased 82% to a record $570,000 in the first half of 2021. The increase followed the previous year's 171% jump to more than $312,000.
"Preventing such attacks in the first place would be the ideal solution but with the new trend of 'ransomware as a service' and human operated ransomware, the scope and the sophistication of attacks are increasing - attackers are using slow and stealth techniques to compromise network, which makes it harder to detect them in the first place," Microsoft security researcher Sylvie Liu wrote in a blog post.
-
Using DeepSeek at work is like ‘printing out and handing over your confidential information’News Thinking of using DeepSeek at work? Think again. Cybersecurity experts have warned you're putting your enterprise at huge risk.
-
Can cyber group takedowns last?ITPro Podcast Threat groups can recover from website takeovers or rebrand for new activity – but each successful sting provides researchers with valuable data
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
-
Google cyber researchers were tracking the ShinyHunters group’s Salesforce attacks – then realized they’d also fallen victimNews In an update to an investigation on the ShinyHunters group, Google revealed it had also been affected
-
Nearly one-third of ransomware victims are hit multiple times, even after paying hackersNews Many ransomware victims are being hit more than once, largely thanks to fragmented security tactics
-
75% of UK business leaders are willing to risk criminal penalties to pay ransomsNews A ransom payment ban is a great idea - until you're the one being targeted...
-
The Scattered Spider ransomware group is infiltrating Slack and Microsoft Teams to target vulnerable employeesNews The group is using new ransomware variants and new social engineering techniques - including sneaking into corporate teleconferences
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crimeNews A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
