The report generated by Interpol's Cybercrime Directorate includes data from 48 Interpol countries and 4 private partners. This analysis was also from Interpol's Cybercrime Threat Response and its Cyber Fusion Centre. The International Criminal Police Organization (Interpol) says [PDF] that "a ransomware campaign carried out mainly through LOCKBIT malware is currently affecting medium-sized companies in some countries within this region."
LockBit is a human-operated Ransomware-as-a-Service (RaaS) operation that surfaced in September 2019 as a private operation targeting enterprises and later observed by Microsoft while targeting healthcare and critical services. This ransomware strain's operators use the publicly available CrackMapExec penetration testing tool to move laterally once they get a foothold on a victim's network.
Two months ago, LockBit partnered with Maze ransomware's operators to create an extortion cartel that allows them to share the same data leak platform during their operations and to exchange tactics and intelligence.
Based on their analysis, CERBER, NetWalker, and Ryuk were the top ransomware families recently detected by Interpol private partners and they are seen as "constantly evolving to maximize the potential damage of a single attack as well as the financial profit for its perpetrators."
"In the first two weeks of April 2020, there was a spike in ransomware attacks by multiple threat groups which had been relatively dormant for the past few months," the Interpol added. "This implies that there may still be organizations that have been infected but where the ransomware has not yet been activated."
Interpol recommends organizations exposed to ransomware attacks to keep their software and hardware up to date, and to back up their data using offline storage devices to block ransomware operators from accessing and encrypting them. New-school security awareness training can ensure your users can spot the warning signs of a ransomware attack.
Bleeping Computer has the full story.