As attackers leave little-to-no traces of their attack patterns, more ransomware groups are shifting from automated attacks to manual attacks.
According to the newly-released Microsoft Digital Defense Report 2023, about 40% of the ransomware attacks detected were human-driven and tracked back to over 120 ransomware-as-a-service (RWaaS) affiliates.
This spike in human-operated ransomware attacks likely goes back to attackers wanting to minimize their footprint within an organization. Think of it this way – all it takes is one detection of something unusual on a single system to alert IT of the attacker’s presence.
One tactic found in these types of attacks is remote encryption. Attackers can choose to encrypt data from multiple systems on a single compromised machine and copy it back to their appropriate repositories. This is much simpler for cybercriminals to do rather than deploy malware on each system and risk process-based detection.
One of the most concerning details around the use of human-operated ransomware is its growth. According to Microsoft, this model of attack has grown over 200% in the last year, and the number of RWaaS affiliates tied to these attacks has grown by 12% in the last year. This signals that 2024 will likely see significant increases in human-operated attacks.
This shift in attack models means more emphasis on initial detection before a threat actor can take control of an endpoint as their foothold into your network. With phishing still being used as the primary method for initial attacks, having a vigilant user base that is continually educated through security awareness training will reduce the likelihood that attackers can gain the needed foothold to begin a ransomware attack.
KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
