As organizations work to protect against the relentless series of ransomware attacks that have plagued businesses large and small, the methods of attack seem to be leveling out.
The old adage “there’s nothing new under the sun” may very well apply to ransomware attacks. According to Andrew Hollister, VP Labs R&D and Deputy CSO at LogRhythm in a recent article at Forbes, despite ransomware being a growing concern, it appears that attack tactics, techniques, and procedures are more or less taking the same paths they have previously.
And it makes sense – whether threat actors are taking the route of RDP or phishing attacks as their initial attack vector (these two have been neck and neck for the last two years as the primary method of initial access), in either case, cybercriminals are limited in scope with what they can do on the target endpoint. So, other than a new vulnerability (which ransomware gangs are actively willing to pay for), the work of infecting an endpoint and its associated network falls to a limited number of actions that can be taken.
The same is true for the initial attack – particularly when phishing is used. Threat actors ultimately need a user to interact with a link, an attachment, a phone number – something – and use social engineering tactics, such as impersonation, establishing credibility, creating a sense of urgency, etc. to entice the potential victim to engage with the malicious content.
And even then, with the exception of the phishing attack campaigning (which tends to mirror current events), phishing attacks still use the same basic principles:
- The email is unsolicited
- It leverages some form of impersonation to establish credibility
- It urges the recipient to click the link or open the attachment
- It often uses pages that look like a legitimate website, but the address field betrays them
- It uses verbiage to elicit an immediate response on the part of the victim
Users that undergo continual Security Awareness Training are far more keen to be suspicious anytime any one of the criteria above are met, assuming the email to be malicious (until proven innocent), and don’t fall for the attack.
Don’t get me wrong, even if it’s true that ransomware attacks aren’t getting any more sophisticated, they still are effective and require proper education to ensure users pay the right amount of attention to keep from falling for the scam.
