{"id":49730,"date":"2022-12-15T00:00:00","date_gmt":"2022-12-15T00:00:00","guid":{"rendered":"urn:uuid:997509a6-3e8f-3a53-5378-aa9b66c6b2c6"},"modified":"2022-12-15T00:00:00","modified_gmt":"2022-12-15T00:00:00","slug":"ransomware-business-models-future-pivots-and-trends","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ransomware-business-models-future-pivots-and-trends\/","title":{"rendered":"Ransomware Business Models: Future Pivots and Trends"},"content":{"rendered":"

<\/p>\n

<\/div>\n

RDP port 3389 remains a popular service abused by ransomware actors to gain initial access to systems located and connected to on-premise infrastructure. However, as more organizations shift to the cloud services for file storage and active directory systems, ransomware groups will look for more opportunities to develop and\/or exploit vulnerabilities not yet leveraged at scale.<\/p>\n

Evolutions<\/span><\/p>\n

Gradual evolutions in the current modern ransomware models as we know them are expected to be tweaked in order to adapt to the triggers that prompt them. From a business perspective, these are \u201cnaturally occurring\u201d movements that prompt movement from their current state.  In this section, we list two gradual evolutions that ransomware actors will likely be undergoing to adapt to the upcoming triggers in the short term. For the full list of evolutions and their respective discussions, you can download our paper here<\/a>.<\/p>\n

Evolution 1: Change of targeted endpoints \u2013 The internet of things (IoT)\/Linux<\/span><\/p>\n

The Mirai botnet<\/a>, which emerged in 2016, was a decisive point that realized the possibility of expanding its reach to Linux devices and the cloud. While it\u2019s not ransomware, the availability of the botnet\u2019s source code allowed parties with the interest and skillset to simply download and recompile the code to infect Linux-based routers to create their own botnet. These address two points for this specific evolution:<\/p>\n