{"id":55288,"date":"2024-02-07T15:49:23","date_gmt":"2024-02-07T15:49:23","guid":{"rendered":"http:\/\/ad21dcc4-30f6-4d16-af76-d98a6ef325dc"},"modified":"2024-02-07T15:49:23","modified_gmt":"2024-02-07T15:49:23","slug":"ransomware-leak-site-reports-rose-by-49-in-2023-but-there-is-good-news","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ransomware-leak-site-reports-rose-by-49-in-2023-but-there-is-good-news\/","title":{"rendered":"Ransomware leak site reports rose by 49% in 2023, but there is good news"},"content":{"rendered":"
\n
\n
\"Cybersecurity<\/picture><\/div>\n

<\/div>\n

Sashkinw\/Getty Images<\/span><\/figcaption><\/figure>\n

Unit 42<\/a> is the threat intelligence and response arm of Palo Alto Networks and has recently released its Ransomware Retrospective 2024: Unit 42 Leak Site Analysis<\/a>. In the report, Unit 42 found a “49% increase in in victims reported by ransomware<\/a> leak sites” compared to 2022. <\/p>\n

According to Unit 42, 2023 saw specific vulnerabilities like SQL injection for MOVEit and GoAnywhere MFT services, as well as an uptick in attacks targeting zero-day vulnerabilities (a vulnerability on a system or device that has been disclosed but not patched).<\/p>\n

The report singled out the MOVEit Transfer hack, undertaken by the Clop Ransomware Gang, which affected more than 3,000 US-based organizations and 8,000 victims globally. The primary sectors hit by these attacks were manufacturing, professional and legal services, and high-tech.<\/p>\n

Also: 7 hacking tools that look harmless but can do real damage<\/a><\/strong><\/p>\n

As far as motivation is concerned, the report states, “Leak site data reveals at least 25 new ransomware groups emerged in 2023, indicating the continued attraction of ransomware as a profitable criminal activity.” Fortunately, the report indicates,  “Despite the appearance of new groups such as Darkrace, CryptNet and U-Bomb, many of these new ransomware threat actors did not last and disappeared during the second half of the year.”<\/p>\n

<\/p>\n

Unit 42 observed 3,998 postings from ransomware leak sites, an increase from 2,679 (for 2022). This was a 49% increase and was likely due to zero-day vulnerabilities, such as “such as CVE-2023-0669<\/a> for GoAnywhere MFT or CVE-2023-34362, CVE-2023-35036 and CVE-2023-35708 for MOVEit Transfer SQL Injection<\/a>.”<\/p>\n

The report also states that not all ransomeware attackers are able to leverage zero-day vulnerabilities because some of the groups were discovered to be run by inexperienced actors. One example of this was an unknown group who targeted VMware ESXi environments, in a campaign labeled ESXiArgs, which exploited CVE-2021-21974<\/a>. That vulnerability had targeted over 3,800 servers and leveraged a flaw that was discovered two years prior to the attack.<\/p>\n

Also: The best VPN services<\/a><\/strong><\/p>\n

The report also lays out some of the new threat groups that were discovered during the year, such as:<\/p>\n