{"id":41831,"date":"2021-07-12T00:00:00","date_gmt":"2021-07-12T00:00:00","guid":{"rendered":"https:\/\/www.trendmicro.com\/en_us\/research\/21\/g\/survey-phishing-ransomware-attacks-are-top-concerns.html"},"modified":"2021-07-12T00:00:00","modified_gmt":"2021-07-12T00:00:00","slug":"survey-phishing-ransomware-attacks-are-top-concerns-vp-threat-intelligence","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/survey-phishing-ransomware-attacks-are-top-concerns-vp-threat-intelligence\/","title":{"rendered":"Survey: Phishing & Ransomware Attacks are Top Concerns VP, Threat Intelligence"},"content":{"rendered":"

<\/p>\n

<\/div>\n

The latest ransomware attack we saw targeting Kaseya<\/a> customers utilized a vulnerability, but if you look at most attacks today, many will start with a phishing email targeting employees. Interestingly our data has shown a shift from these emails containing either a weaponized attachment or a malicious link, to having both now.  Malicious actors apparently are hoping an employee falls for one or the other. <\/p>\n

As a side note, as I was reading this report, which was written not too long ago, I saw this statement and thought it was quite prophetic as we\u2019re currently dealing with the Kaseya attack that started the Friday afternoon of the July 4th<\/sup> holiday weekend:<\/p>\n

Cybercriminals are also embracing underhanded guerrilla-warfare tactics to create massively disruptive encryption events at the worst time possible for an organization\u2014such as late in the evening just before a major holiday weekend or vacation, or the day before school starts in the education sector. Such timing increases the social pressure on everyone who has a say in the resolution, making payment of the ransom seem like the easiest way out of the immediate problem.<\/i><\/p>\n

Modern ransomware<\/a> attacks now follow a model where the targeted victim\u2019s network is infiltrated first using a method like phishing, then the actors will laterally move to their critical business systems to deploy the ransomware.  In fact, ransomware is usually the last attack on the network since it is so visible.  Prior to executing the ransomware they may have exfiltrated data in a double extortion effort.  So in many cases, these two threats are part of a single campaign against an organization and need to be viewed as such. <\/p>\n

Somewhat concerning from the survey was that 37% of organizations believed they were highly effective at counteracting 11 or more of the phishing and ransomware threats.  This means almost two thirds of these organizations felt they weren\u2019t very effective at countering these two threats.  Part of the challenge is how well employees are educated about these threats.  From the survey, less than half (45%) were fairly or completely confident that all employees could recognize an email-based phishing threat.  This was even worse for recognizing malware or ransomware attempts (39%). <\/p>\n

From a defense perspective, we\u2019ve seen Artificial Intelligence and Machine Learning (AI\/ML) become mainstream technologies in defending against both of these threats.  In fact, ML scanners are detecting ransomware so well that malicious actors now routinely have to turn off security agents running these to ensure endpoints get infected with their malware.  But a troubling stat from the survey found only 6% of organizations continually use these defense technologies.  We\u2019ve also seen in many cases where infections have occurred that customers have not enabled our AI\/ML within the solutions that support them.  My recommendation for any organization who wants to improve protection against these threats is very similar to what is recommended within the report:<\/p>\n

To protect against phishing attacks:<\/p>\n