Ransomware and Microsoft Exchange Server attacks are surging

Issue 2 2021 Information Security

Check Point Research (CPR) is observing global surges in ransomware attacks, alongside an increase in cyberattacks targeting vulnerabilities in Microsoft Exchange servers. The revelation comes at a time when CISA (the USA’s Cybersecurity and Infrastructure Security Agency) has raised alarm bells about ransomware attacks against Microsoft Exchange servers, in addition to other security researchers who have already detected at least two groups leveraging Microsoft Exchange vulnerabilities to infect victims with ransomware, the BlackKingdom ransomware group and another unknown group deploying a new malware strain called DearCry.

CPR has spotted the following trends and data around ransomware attacks based on organisations it tracks:

Since October 2020, there has been a 57% increase in the number of organisations affected by ransomware globally.

• Since the beginning of 2021, the number of organisations affected by ransomware has been growing at 9% month over month.

• In the past six months, there has been a general increase in the number of attacks involving human-operated ransomware, such as Maze and Ryuk.

• In total, 3868 organisations have been affected.

• The top three countries that saw the most ransomware attack attempts are USA (12%), Israel (8%) and India (7%).

• The top three industry sectors that saw the most ransomware attack attempts are government/military (18%), manufacturing (11%), and finance/banking (8%).

CPR also found the following trends and data around cyberattacks that have targeted Microsoft Exchange servers:

The number of attacks involving Exchange server vulnerabilities has tripled.

• Over 50 000 attack attempts have now been documented by CPR on Microsoft Exchange servers.

• The most targeted industries are government/military, manufacturing and then banking/finance.

• The most affected country is the United States (49% of all exploit attempts), followed by the United Kingdom (5%), the Netherlands (4%) and Germany (4%).

WannaCry trends, again

WannaCry is trending again. WannaCry is a ransomware worm that spread rapidly through a number of computer networks in May of 2017. After infecting a Windows computer, it encrypts files on the PC’s hard drive, making them impossible for users to access, then demands a ransom payment in bitcoin in order to decrypt them. CPR has spotted the following trends and data around WannaCry:

Since the beginning of the year, the number of organisations affected by WannaCry globally has increased by 53%.

• There are 40 times more affected organisations in March 2021 when compared to October 2020.

• The new samples still use the EternalBlue exploit to propagate.

Lotem Finkelsteen, Check Point's manager of threat intelligence, comments: “Two trends are happening concurrently. One, cyberattacks targeting Microsoft Exchange servers are increasing sharply. Two, ransomware attacks are simultaneously rising steadily. Although we have not concluded that the two trends are directly related just yet, there is reason for concern. We do believe the Microsoft Exchange vulnerabilities opened up another door into organisations. And so Check Point Research is also raising the alarm bells, just like CISA has. We’re urging organisations to act now, before ransomware gangs make Exchange exploits popular. In cybercrime, we rarely see businesses that demonstrate constant growth, or rapid adjustments to changing factors, as well as quick adoptions of new technologies. Ransomware is one of those rare businesses.”

How organisations can protect against ransomware

1. Back up all data – One of the most important tasks is backing up your company’s data. If something goes wrong, your data should be able to quickly and easily revert to a previous version.

2. Keep software updated – Ransomware attackers sometimes find an entry point within apps and software, noting vulnerabilities and capitalising on them. Fortunately, some developers actively search for new vulnerabilities and patch them.

3. Use better threat detection – Most ransomware attacks can be detected and resolved before it’s too late. To maximise your chances of protection, have automated threat detection in place in your organisation.

4. Adopt multifactor authentication – Multifactor authentication forces users to verify their identities in multiple ways before they’re granted access to a system. This way, if an employee mistakenly gives their password to a cybercriminal, the criminal won’t be able to gain easy access to your systems.

5. Scan and monitor emails and file activity – Emails are a common choice for cybercriminals executing phishing schemes, so take the time to scan and monitor emails on an ongoing basis, and consider deploying an automated email security solution to block malicious emails from ever reaching users.

Find out more at www.checkpoint.com




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Empower individuals to control their biometric data
Information Security Access Control & Identity Management Security Services & Risk Management
What if your biometrics, now embedded in devices, workplaces, and airports, promising seamless access and enhanced security, was your greatest vulnerability in a cyberattack? Cybercriminals are focusing on knowing where biometric data is stored.

Read more...
Strategies for combating insider threats
Information Security Security Services & Risk Management
In Africa, insider threats pose an increasingly significant risk to businesses, driven by economic uncertainty, labour disputes, and rapid digital transformation. These threats can arise from various sources, including disgruntled employees and compromised third-party service providers

Read more...
Five tech trends shaping business in 2025
Information Security Infrastructure
From runaway IT costs to the urgent need for comprehensive AI strategies that drive sustainable business impact, executives must be prepared to navigate a complex and evolving technology environment to extract maximum value from their investments.

Read more...
Kaspersky’s predictions for 2025 APT landscape
Information Security
The 2025 advanced persistent threat (APT) includes the rise of hacktivist alliances, increased use of AI-powered tools by state-affiliated actors – often with embedded backdoor – more supply chain attacks on open-source projects.

Read more...
SecurityHQ certified B-BBEE Level 1: Delivering global services from a local entity
SecurityHQ Information Security
SecurityHQ, a global managed security services provider (MSSP) with an office in South Africa, has announced it can now offer local companies a complete managed cybersecurity service from a Level-1 B-BBEE accredited and 51% black-owned service provider.

Read more...
2024, the year of Fraud-as-a-Service
Information Security
A report from AU10TIX outlines how ‘the industry’s dark engine’ offers user-friendly fraud kits that enable amateurs to execute complex attacks against thousands of accounts in minutes.

Read more...
The future of endpoint security
Information Security
Endpoint security is a critical pillar of cybersecurity, especially for South African businesses, which are becoming prime targets for cybercriminals. Endpoint security involves safeguarding devices connected to a network from a range of cyberthreats.

Read more...
Not enough businesses take cybercrime seriously
Information Security
Interpol recently revealed that cybercrime, specifically ransomware incidents, cost the South African economy up to 1% of the country’s GDP, while the Council for Scientific and Industrial Research estimated the loss at R2,2 billion a year.

Read more...
Navigating today’s cloud security challenges
Information Security Infrastructure
While the cloud certainly enables enterprises to quickly adapt to today’s evolving demands, it also introduces unique challenges that security teams must recognise and manage. Vincent Hwang offers insights from the 2025 State of Cloud Security Report.

Read more...