How Come Unknown Attack Vectors are Surging in Ransomware Infections?

Unknown Initial Attack Vectors

Trend analysis of ransomware attacks in the first quarter of this year reveals a continual increase in the number of "unknown" initial attack vectors, and I think I understand why.

There are two reports that you should be keeping an eye on—the updated Verizon Data Breach Report and Coveware’s Quarterly Ransomware Reports.

In Coveware's Q1 report, we see a continuing upward trend in “unknown” as the top initial attack vector. 

Coveware Report

Source: Coveware

Historically, phishing and remote access compromise (formerly reported as RDP compromise) seemed to battle for the top spot each quarter. Simultaneously, as the occurrence of "unknown" and phishing increased, remote access compromise also appeared to rise, though at a slower pace.

Then it hit me: A fair amount of “unknown” could be attributed to phishing. 

Let’s address the growth in remote access compromise. The growth in the number of compromised credentials on the dark web is fueling this. And where are those credentials obtained? Phishing-based credential harvesting campaigns. So, it’s likely a material portion of the ransomware attacks attributed to remote access compromise also involve phishing. 

Now let’s talk about the decline in phishing.  We saw in the Verizon report that 89% of users that click a malicious link don’t report it. While organizations may find an instance or remnants of malware post-attack on an endpoint, they have no idea how it got there because users aren’t reporting their interaction with phishing emails. So, I’m going to add a bunch more to phishing – this time from “Unknown."

Finally, regarding "Unknown" itself, Coveware has commented on the attack vector's rise:

“It should be noted that while the clear attack vector may be unidentified by forensics, the initial access is typically just one of a dozen or so tactics necessary to achieve extortion level impact, often chained together (e.g., email phishing, RDP compromise, software vulnerability).”

Where does this leave organizations today? 

Fortunately, not in a position of complete uncertainty. Revisiting the chart and considering the "adjusted" role of phishing, it becomes clear that the focus should still be on the three prevailing threat vectors: phishing, remote access and software vulnerabilities.

The reality is threat actors only have so many ways of gaining entry into an organization. By focusing on the three primary threat vectors, your preventative strategy becomes truly practical and impactful.

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Free Ransomware Simulator Tool

Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 24 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RansIm-Monitor3Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 25 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing, Ransomware

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews