[BEWARE] New Report on Doxxing Exposes Cybercriminal Trends

Screen Shot 2020-06-04 at 12.08.17 PMA new threat intelligence report on doxxing, researched by cybersecurity experts at Kivu, reveals that the majority of attacks occur in the U.S., with companies in the consumer sector being more likely to fall victim to such an attack.

Doxxing is the deliberate and malicious leaking of stolen data that happens once a ransomware attack has been deployed, says Kivu. Kivu, a cybersecurity solutions provider, has documented the active doxxing efforts of eight ransomware groups: Maze, REvil, DoppelPaymer, CL0P, Nephilim, Sekhmet, Mespinoza (PYSA) and RagnarLocker. A full breakdown of ransomware variant targets can be found in the report.

In What Doxxing Victims Reveal About “Targeted Attacks”, Kivu has analyzed the geographic and industry-based metrics of over 140 ransomware victims who were doxxed between February 1, 2020 and May 1, 2020. During this period, Kivu found that 55 percent of victims were based in the US, which is a stark departure from several 2019 reports that stated ransomware affects other regions of the world more frequently.

The recent findings suggest this disproportionate representation of US victims is likely the result of (a) more US victims being targeted, (b) more US victims refusing to pay, and (c) the geographic preferences of ransomware’s malware partners becoming more focused on the US in recent years.

Kivu’s analysis of industry-based trends revealed that the most commonly attacked business (30 percent of all attacks) fell within the consumer sector, which is comprised of non-essential goods and services such as retail, accounting services, and entertainment. Kivu concluded the profiles of doxxed victims demonstrated that companies are not being targeted based on how high profile they are or the kind of data they store, but instead are first and most targeted because of a vulnerability in their network.

Key findings:

  • 55 percent of all doxxed victims were located or headquartered in the US, followed by 7 percent in the UK and 4 percent in France. The remaining 34 percent of victims were spread out across the globe.
  • Companies that fall under the consumer sector were the most represented in the data at 30 percent. This was followed by 22 percent in industrials and 15 percent in financial services.
  • Kivu’s investigation showed that ransomware variants generally do not favor one industry over another – rather, they are likely to deploy more successfully within certain environments, which are industry agnostic.

The full report can be accessed here. Security Magazine has the full story: https://www.securitymagazine.com/articles/92511-new-report-on-doxxing-exposes-cyber-threat-actors-trends

Free Ransomware Simulator Tool

Bad guys are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 18 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RanSimScreen-1Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 19 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:


Topics: Ransomware, KnowBe4

Subscribe To Our Blog

Ransomware Has Gone Nuclear Webinar

Get the latest about social engineering

Subscribe to CyberheistNews