As attackers leave little-to-no traces of their attack patterns, more ransomware groups are shifting from automated attacks to manual attacks.
According to the newly-released Microsoft Digital Defense Report 2023, about 40% of the ransomware attacks detected were human-driven and tracked back to over 120 ransomware-as-a-service (RWaaS) affiliates.
This spike in human-operated ransomware attacks likely goes back to attackers wanting to minimize their footprint within an organization. Think of it this way – all it takes is one detection of something unusual on a single system to alert IT of the attacker’s presence.
One tactic found in these types of attacks is remote encryption. Attackers can choose to encrypt data from multiple systems on a single compromised machine and copy it back to their appropriate repositories. This is much simpler for cybercriminals to do rather than deploy malware on each system and risk process-based detection.
One of the most concerning details around the use of human-operated ransomware is its growth. According to Microsoft, this model of attack has grown over 200% in the last year, and the number of RWaaS affiliates tied to these attacks has grown by 12% in the last year. This signals that 2024 will likely see significant increases in human-operated attacks.
This shift in attack models means more emphasis on initial detection before a threat actor can take control of an endpoint as their foothold into your network. With phishing still being used as the primary method for initial attacks, having a vigilant user base that is continually educated through security awareness training will reduce the likelihood that attackers can gain the needed foothold to begin a ransomware attack.
KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Here's how it works:
