Phishing Emails Top the List as the Initial Attack Vector for Ransomware Attacks

The latest data on ransomware trends from backup vendor Veeam demonstrate the impact these attacks have on backups and an organization’s ability to recover.

Whenever we’re talking about ransomware attacks, there needs to be a discussion had about backups and an ability to be operationally resilient through recovery. But, according to Veeam’s 2022 Ransomware Trends Report, organizations are not truly prepared for the sophisticated attacks they are facing.

These attacks target backups with intensity, seeking to remove your ability to recover without first paying the ransom. According to the report:

• Backup repositories are targeted in 94% of attacks
• These same repositories were impacted in some way in 68% of attacks
• Attackers targeted specific system and platforms (think Windows, VMware, NAS, etc.) in 80% of attacks
• On average, 47% of all data was encrypted
• And for those thinking to just pay the ransom, of those organizations that paid the ransom, 31% of them still could not recover their data

And while most organizations are able to begin recovery efforts within minutes-to-hours, a whopping 93% of organizations say it took between a week to 4 months to be completely operational again.

So, how are these very impactful attacks gaining entrance into your network? According to the report, phishing emails, malicious links, etc. were the initial attack vector in 44% of ransomware attacks (infected software, external RDP credential spraying, insider threat, and zero day/critical vulnerabilities followed as top attack vectors).

Your protective cybersecurity strategy needs to stand toe-to-toe with threat actor’s actions. If they are using phishing, you need to be laser focused on how to stop each and every malicious email that comes in. Software solutions play a role, but so do the users interacting with their Inboxes. Those that have been enrolled in Security Awareness Training will be far more likely to spot a phishing attack and stop it before it gains traction.

It's evident from the Veeam data, you can’t afford to have a ransomware attack hit your organization. The emphasis must be placed on stopping the attacks where they start – at the Inbox.