The rise in ransomware at LockBit 3.0 shows that the cybercrime epidemic is far from over

Cyber ​​crime is rampant. But while the Lapsus$ group’s latest exploits have garnered a lot of attention, especially in the wake of the Uber and GTA VI breaches, LockBit 3.0 has largely remained under the radar despite racking up dozens of casualties.

In fact, according to research released today by NCC Groups Global Threat Intelligence Team, Lockbit 3.0 was responsible for 40% of all ransomware incidents in August, making it the most threatening ransomware threat of the month, involved in a total of 64 incidents.

This wave of ransomware comes shortly after the group switched from LockBit 2.0 earlier this year in June. It also comes after the gang made the decision to employ triple extortion techniques to obtain the maximum payout from target organizations.

Above all, these findings indicate that ransomware threats are here to stay, at least for now, meaning businesses must be prepared to avoid intruders if they want to avoid getting into the lose-lose situation of paying ransom or losing high value. data.

Ransomware: A Virtual Plague That Won’t Go Away

It’s no secret that ransomware remains one of the most serious and persistent cyber threats facing modern enterprises.

Earlier this year, Verizon research found that ransomware attacks increased by 13 percent year-over-year, highlighting that 82% of breaches involved the human element.

Unfortunately, other analysts are not optimistic that ransomware threats will diminish in the near term. just last month, acronis released a report estimating that global damage from ransomware will exceed $30 billion by 2023.

NCC Group’s findings appear to reflect this dismal assessment, despite a small decrease in the number of attacks.

“While the number of attacks decreased slightly in August, there have been significant changes especially among threat groups,” said Matt Hull, Global Head of Threat Intelligence at NCC Group.

“LockBit 3.0 appears to be restarting its operations since its June rebrand, while Conti affiliate BlackBasta appears to be establishing itself in the ransomware landscape following the rebranding of Conti’s operations,” said Hull.

Hull also noted that new threat actor IceFire arrived on the scene in the second half of August with a spate of attacks targeting web hosting services in an effort to collect the largest amount of data possible.

The way forward: security awareness

To address ransomware threats, organizations need to focus on reducing human risk and teaching employees how to better manage their credentials.

Nowhere is the need for this more clearly illustrated than the fact that 25% of the S&P 500, and half of America’s 20 most valuable public companies, have had at least one reference for sale on the dark web.

With regular security awareness training, companies can teach their employees security best practices such as selecting strong passwords, the importance of not clicking links or attachments in phishing emails, and enabling multi-factor authentication can be a big deal. contribute to reducing ransomware breaches.

This training can then be supplemented with vulnerability and attack surface management solutions, which can help identify and mitigate exploits in the environment. After all, the fewer access points there are, the better.