“Unknown” Initial Attack Vectors Continue to Grow and Plague Ransomware Attacks

Unknown Initial Attack Vectors

Trend analysis of ransomware attacks in the first quarter of this year reveals a continual increase in the number of "unknown" initial attack vectors, and I think I might understand why.

There are two reports that you should be keeping an eye on—the updated Verizon Data Breach Report and ransomware response vendor Coveware’s Quarterly Ransomware Reports.

In their latest report covering Q1 of this year, we see a continuing upward trend in “unknown” as the top initial attack vector. 

Coveware Report

Source: Coveware

Historically, phishing and remote access compromise (formerly reported as RDP Compromise) seemed to battle for the top spot each quarter. Simultaneously, as the occurrence of "unknown" and phishing increased, remote access compromise also appeared to rise, though at a slower pace.

What does this tell us about cyber attacks and why are they occurring without an understanding of what attack vector is being used. At the same time as the popularity of “unknown” and phishing grew, remote access compromise seemed to also grow.

Then it hit me: A fair amount of “unknown” could be attributed to phishing. 

Let’s address the growth in remote access compromise. The growth in the number of compromised credentials on the dark web is what is fueling this. And where are those credentials obtained? Phishing-based credential harvesting campaigns. So, it’s likely a material portion of the ransomware attacks attributed to remote access compromise also involve phishing. 

Now let’s talk about the decline in phishing.  We saw in the Verizon report that 89% of users that click a malicious link don’t report it. While organizations may find an instance or remnants of malware post-attack on an endpoint, they have no idea how it got there because users aren’t reporting their interaction with phishing emails. So, I’m going to add a bunch more to phishing – this time from “Unknown”.

Finally, regarding "Unknown" itself, Coveware has commented on the attack vector's rise:

“It should be noted that while the clear attack vector may be unidentified by forensics, the initial access is typically just one of a dozen or so tactics necessary to achieve extortion level impact, often chained together (e.g., email phishing, RDP compromise, software vulnerability).”

In other words, even they know some of “Unknown” is actually the other vectors but their customers simply can’t pin the specific vector down.

Where does this leave organizations today? 

Fortunately, not in a position of complete uncertainty. Revisiting the chart and considering the "adjusted" role of phishing, it becomes clear that the focus should still be on the three prevailing threat vectors: phishing, remote access, and software vulnerabilities.

The reality is threat actors only have so many ways of gaining entry into an organization. By focusing on the three primary threat vectors, your preventative strategy becomes truly practical and impactful.

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Free Ransomware Simulator Tool

Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 24 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RansIm-Monitor3Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 25 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:


Topics: Phishing, Ransomware

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews