{"id":42729,"date":"2021-09-07T15:08:21","date_gmt":"2021-09-07T15:08:21","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/32620\/Report-This-Is-The-Perfect-Ransomware-Victim.html"},"modified":"2021-09-07T15:08:21","modified_gmt":"2021-09-07T15:08:21","slug":"report-this-is-the-perfect-ransomware-victim","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/report-this-is-the-perfect-ransomware-victim\/","title":{"rendered":"Report: This Is The Perfect Ransomware Victim"},"content":{"rendered":"

Researchers have explored what the perfect victim looks like to today’s ransomware groups. <\/p>\n

On Monday, KELA published a report<\/a> on listings made by ransomware operators in the underground, including access requests — the way to gain an initial foothold into a target system — revealing that many want to buy a way into US companies with a minimum revenue of over $100 million. <\/p>\n

Initial access is now big business. Ransomware groups such as Blackmatter and Lockbit may cut out some of the legwork involved in a cyberattack by purchasing access, including working credentials or the knowledge of a vulnerability in a corporate system.  <\/p>\n

When you consider a successful ransomware campaign can result in payments worth millions of dollars<\/a>, this cost becomes inconsequential — and can mean that cybercriminals can free up time to strike more targets.  <\/p>\n

The cybersecurity company’s findings, based on observations in dark web forums during July 2021, suggest that threat actors are seeking large US firms, but Canadian, Australian, and European targets are also considered.  <\/p>\n

Russian targets are usually rejected immediately, and others are considered “unwanted” — including those located in developing countries — likely because potential payouts are low.  <\/p>\n

Roughly half of the ransomware operators will, however, reject offers for access into organizations in the healthcare and education sector, no matter the country. In some cases, government entities and non-profits are also off the table. <\/p>\n

<\/section>\n

In addition, there are preferred methods of access. Remote Desktop Protocol (RDP), Virtual Private Network (VPN)-based access prove popular. Specifically, access to products developed by companies including Citrix, Palo Alto Networks, VMWare, Cisco, and Fortinet.   <\/p>\n

“As for the level of privileges, some attackers stated they prefer domain admin rights, though it does not seem to be critical,” the report states. <\/p>\n

\"screenshot-2021-09-06-at-10-48-49.png\"<\/span>