2722<\/strong><\/h2>\n<\/div>\n\n\n\n\n That's the total number of ransomware attacks claimed in 2021<\/strong>, corresponding to 7 claims per day <\/p>\n<\/div>\n<\/div>\n\n\n\n\n\nTargeted geography<\/strong>
When looking at the victimology of ransomware operators, one significant fact stands out: the geographical distribution of victims. Although few countries have been separated (108 countries targeted in total), this victimology points to two major trends:
\u2013 North America and Western Europe entities represent priority targets for these actors
\u2013 The Commonwealth of Independent States (CIS) and Russia remain untouched areas by these attacks
Most active ransomware operators in France<\/strong>
The majority of incident responses involving Intrinsic CERT<\/a> have been from actors whose attribution cannot be certain. However, several cases have been explicit enough to be able to determine with certainty the nature of the ransomware operators. This year, among the observed cases, the most prolific actors were Conti, Darkside, Ryuk and Lockbit. Our daily monitoring of data leak websites shows that these actors remain in the top 10 most active ransomware affiliates against French entities (see Figure 1.)
Most common techniques used by the most active ransomware operators<\/strong>
We have analyzed the tactics, techniques and procedures employed by the 10 most active ransomware operators in 2021. This analysis reveals that the following techniques are shared by at least 6 of the 10 selected groups:
\u2013 Initial Access: External Remote Services (T113)
\u2013 Execution: Command and Scripting Interpreter (T1059)
\u2013 Defense Evasion: Impair Defense (Disable or Modify Tools) (T1562.001)
\u2013 Discovery: File and Directory Discovery (T1083)
<\/p>\n<\/div>\n\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2022\/02\/2007.i039.019_cyber_security_spyware_data_protection_isometric_set-01-2-1024x1024.jpg\")
<\/figure><\/div>\n<\/div>\n<\/div>\n\n\n\n<\/p>\n\n\n\n
<\/p>\n\n\n\n
Top 10 most active ransomware against France in 2021<\/h2>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2022\/02\/top-10.png\")
Figure 1. Most active ransomware operators against French entities, based on data leak website monitoring<\/em><\/figcaption><\/figure><\/div>\n\n\n\n<\/p>\n\n\n\n
<\/p>\n\n\n\n
Initial access vector: vulnerabilities and phishing on the top<\/h2>\n\n\n\n
Our SOC and CERT operations as well as our monitoring on hacking platforms shows that phishing <\/a>and vulnerabilities exploitation remain the most common techniques employed by threat actors to gain an initial foothold on targeted networks.<\/p>\n\n\n\n\n\n<\/p>\n\n\n\n
Operation of remote access appliances<\/strong>
This is a trend largely documented in 2020 after the beginning of the Covid-19 pandemic, RDP and VPN appliances used by employees to access their network remotely increased the attack surface of the corporate network. On the 49 missions covered by our CERT throughout 2021 and with a pandemic still ongoing, Citrix, Fortinet, SonicWall and Pulse appliances have been largely exploited by threat actors to compromised networks. The interest in RDP is also largely observed on hacking platforms with a lot of initial access brokers specialized in selling this type of product as shown in the next slide.<\/p>\n<\/div>\n\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2022\/02\/11121-1024x683.jpg\")
<\/figure><\/div>\n<\/div>\n<\/div>\n\n\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2022\/02\/4799410-1024x683.jpg\")
<\/figure><\/div>\n<\/div>\n\n\n\n\nMost frequent vulnerabilities<\/strong>
Among the most exploited vulnerabilities identified by our CERT in 2021, Microsoft Exchange Server and ProxyShell exploits in particular are far ahead in terms of frequency with 18% of incidents involving one of these vulnerabilities. However, more than 20% of all the vulnerabilities observed by our CERT as being actively exploited in 2021 are dating back from 2020, 2019 and 2018. Patches are not always applied immediately, allowing threat actors to exploit vulnerabilities months after their public releases. For example, ZeroLogon's vulnerability CVE-2020-1472, discovered in 2020, has continued to be exploited by actors such as Conti and Darkside during the first half of 2021. This interest for vulnerabilities demonstrated by threat actors is largely supported by our SOC operations as in 15,496 detections in 2021 \u201cExecution of malicious code attempts\u201d remains one of the most observed one (13%).<\/p>\n<\/div>\n<\/div>\n\n\n\n\n\nPhishing<\/strong>
Two key statistics highlighted by our SOC<\/a> and CERT reveal that threat actors keep using phishing to get an initial foothold on a network:
\u2013 12% of the incident responses conducted by CERT Intrinsec involved phishing attempts;
\u2013 The incident type \u201cmalicious link\u201d is among the most observed one by our SOC (alongside aggressive port scans, aggressive subnet scans and bruteforce attempts)
This initial access technique is used by threat actors distributing loaders such as Emotet, IceID, Bazar Loader or QakBot. This type of threat continues to target corporates and is often combined with other threats such as the exploitation of known vulnerabilities or ransomware, making them potentially<\/p>\n<\/div>\n\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2022\/02\/3892309-1024x1024.jpg\")
<\/figure><\/div>\n<\/div>\n<\/div>\n\n\n\n<\/p>\n\n\n\n
<\/p>\n\n\n\n
Cybercrime marketplace still going strong<\/h2>\n\n\n\n
The activity on cybercrime marketplaces keeps growing, as well as shifting from Dark towards Surface Web platforms. Our investigations conducted on these networks throughout 2021 identify particularly strong demand for the diverse typologies of criminal goods and services as follows:<\/p>\n\n\n\n
33% Vulnerabilities<\/h3>\n\n\n\n
Pronounced interest in buying\/selling Remote Desktop Protocol configurations for fraudulent access to systems of companies operating across multiple sectors. SQL injections to target vulnerable websites are also in high demand.<\/p>\n\n\n\n
<\/p>\n\n\n\n
33% Customer Data<\/h3>\n\n\n\n
Stolen customer databases, containing sensitive information such as connection credentials to various online services or financial data, remain one of the most popular goods on cybercrime networks.<\/p>\n\n\n\n
<\/p>\n\n\n\n
29% Company Data<\/h3>\n\n\n\n
Employee connection credentials to internal companies' internal services, ie efficient vectors of compromise, are a sought-after product. Likewise for internal sensitive or confidential data, such as strategic projects or HR information.<\/p>\n\n\n\n
<\/p>\n\n\n\n
5% Counterfeit goods \/ services<\/h3>\n\n\n\n
Demand for counterfeit goods and services on criminal marketplaces is persistent, although handled to a lesser extent from the viewpoint of CTI teams (dealing mostly with cases of fraudulent configurations imitating real services).<\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
Zero-days and supply chain attacks<\/h2>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2022\/02\/Schema-CTI-1024x500.png\")
<\/figure><\/div>\n\n\n\n<\/p>\n\n\n\n
<\/p>\n\n\n\n
Most impactful 2021 flaws involving Zero-Day vulnerabilities and\/or a supply chain attack<\/h2>\n\n\n\n
<\/p>\n\n\n\n
\n\n\nJANUARY 2021<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2022\/02\/image-22.png\")
<\/a><\/figure><\/div>\n\n\n\n<\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
05\/01\/2021<\/strong>
US intelligence agencies formally accuse Russia of association with the SolarWinds attack that dates back in September 2019<\/p>\n\n\n\nRussian-state sponsored attackers inserted a backdoor into SolarWinds Orion IT monitoring software updates to 18,000 government entities and Fortune 500 companies. Through this, malware was distributed to at least nine US federal agencies and more than 100 companies<\/p>\n<\/div>\n\n\n\n
<\/div>\n<\/div>\n<\/div><\/div>\n\n\n\n<\/p>\n\n\n\n
<\/p>\n\n\n\n
\n<\/div>\n\n\n\n\nMARCH 2021<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2022\/02\/image-23.png\")
<\/figure>\n\n\n\n01\/03\/2021<\/strong>
Accellion releases a latest patch based on IR mandiant report fixing a series of 0-day vulnerabilities affecting Accellion File Transfer Appliance compromised that started back in December 2020;<\/p>\n\n\n\nAttacks carried out by a Russian-speaking cybercriminal group known as FIN11 using zero-days against Accellion FTA servers hit around 100 companies across the world in December 2020 and January 2021. In some cases FIN11 leveraged CLOP double extortion infrastructure<\/p>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2022\/02\/image-24.png\")
<\/a><\/figure>\n\n\n\n03\/03\/2021<\/strong>
Mass exploitation of Microsoft on-prem Exchange RCE dubbed Proxylogon. Indications of retroactive exploitation dating back two weeks<\/p>\n\n\n\nIn March 2021 Chinese cyber espionage groups exploited four vulnerabilities in Microsoft's on-premises Exchange Server software. This compromised more than 100,000 servers worldwide.
Beyond the intelligence gathering from emails, the latter were abused for hijack existing email threads by the infamous Emotet botnet<\/p>\n<\/div>\n<\/div>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
\n\n
That's the total number of ransomware attacks claimed in 2021<\/strong>, corresponding to 7 claims per day <\/p>\n<\/div>\n<\/div>\n\n\n\n Targeted geography<\/strong> <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Our SOC and CERT operations as well as our monitoring on hacking platforms shows that phishing <\/a>and vulnerabilities exploitation remain the most common techniques employed by threat actors to gain an initial foothold on targeted networks.<\/p>\n\n\n\n <\/p>\n\n\n\n Operation of remote access appliances<\/strong> Most frequent vulnerabilities<\/strong> Phishing<\/strong> <\/p>\n\n\n\n <\/p>\n\n\n\n The activity on cybercrime marketplaces keeps growing, as well as shifting from Dark towards Surface Web platforms. Our investigations conducted on these networks throughout 2021 identify particularly strong demand for the diverse typologies of criminal goods and services as follows:<\/p>\n\n\n\n Pronounced interest in buying\/selling Remote Desktop Protocol configurations for fraudulent access to systems of companies operating across multiple sectors. SQL injections to target vulnerable websites are also in high demand.<\/p>\n\n\n\n <\/p>\n\n\n\n Stolen customer databases, containing sensitive information such as connection credentials to various online services or financial data, remain one of the most popular goods on cybercrime networks.<\/p>\n\n\n\n <\/p>\n\n\n\n Employee connection credentials to internal companies' internal services, ie efficient vectors of compromise, are a sought-after product. Likewise for internal sensitive or confidential data, such as strategic projects or HR information.<\/p>\n\n\n\n <\/p>\n\n\n\n Demand for counterfeit goods and services on criminal marketplaces is persistent, although handled to a lesser extent from the viewpoint of CTI teams (dealing mostly with cases of fraudulent configurations imitating real services).<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n JANUARY 2021<\/strong><\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n 05\/01\/2021<\/strong> Russian-state sponsored attackers inserted a backdoor into SolarWinds Orion IT monitoring software updates to 18,000 government entities and Fortune 500 companies. Through this, malware was distributed to at least nine US federal agencies and more than 100 companies<\/p>\n<\/div>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n MARCH 2021<\/strong><\/p>\n\n\n\n 01\/03\/2021<\/strong> Attacks carried out by a Russian-speaking cybercriminal group known as FIN11 using zero-days against Accellion FTA servers hit around 100 companies across the world in December 2020 and January 2021. In some cases FIN11 leveraged CLOP double extortion infrastructure<\/p>\n\n\n\n 03\/03\/2021<\/strong> In March 2021 Chinese cyber espionage groups exploited four vulnerabilities in Microsoft's on-premises Exchange Server software. This compromised more than 100,000 servers worldwide. <\/p>\n\n\n\n <\/p>\n\n\n\n
When looking at the victimology of ransomware operators, one significant fact stands out: the geographical distribution of victims. Although few countries have been separated (108 countries targeted in total), this victimology points to two major trends:
\u2013 North America and Western Europe entities represent priority targets for these actors
\u2013 The Commonwealth of Independent States (CIS) and Russia remain untouched areas by these attacks
Most active ransomware operators in France<\/strong>
The majority of incident responses involving Intrinsic CERT<\/a> have been from actors whose attribution cannot be certain. However, several cases have been explicit enough to be able to determine with certainty the nature of the ransomware operators. This year, among the observed cases, the most prolific actors were Conti, Darkside, Ryuk and Lockbit. Our daily monitoring of data leak websites shows that these actors remain in the top 10 most active ransomware affiliates against French entities (see Figure 1.)
Most common techniques used by the most active ransomware operators<\/strong>
We have analyzed the tactics, techniques and procedures employed by the 10 most active ransomware operators in 2021. This analysis reveals that the following techniques are shared by at least 6 of the 10 selected groups:
\u2013 Initial Access: External Remote Services (T113)
\u2013 Execution: Command and Scripting Interpreter (T1059)
\u2013 Defense Evasion: Impair Defense (Disable or Modify Tools) (T1562.001)
\u2013 Discovery: File and Directory Discovery (T1083)
<\/p>\n<\/div>\n\n\n\n<\/figure><\/div>\n<\/div>\n<\/div>\n\n\n\nTop 10 most active ransomware against France in 2021<\/h2>\n\n\n\n
Initial access vector: vulnerabilities and phishing on the top<\/h2>\n\n\n\n
This is a trend largely documented in 2020 after the beginning of the Covid-19 pandemic, RDP and VPN appliances used by employees to access their network remotely increased the attack surface of the corporate network. On the 49 missions covered by our CERT throughout 2021 and with a pandemic still ongoing, Citrix, Fortinet, SonicWall and Pulse appliances have been largely exploited by threat actors to compromised networks. The interest in RDP is also largely observed on hacking platforms with a lot of initial access brokers specialized in selling this type of product as shown in the next slide.<\/p>\n<\/div>\n\n\n\n<\/figure><\/div>\n<\/div>\n<\/div>\n\n\n\n<\/figure><\/div>\n<\/div>\n\n\n\n
Among the most exploited vulnerabilities identified by our CERT in 2021, Microsoft Exchange Server and ProxyShell exploits in particular are far ahead in terms of frequency with 18% of incidents involving one of these vulnerabilities. However, more than 20% of all the vulnerabilities observed by our CERT as being actively exploited in 2021 are dating back from 2020, 2019 and 2018. Patches are not always applied immediately, allowing threat actors to exploit vulnerabilities months after their public releases. For example, ZeroLogon's vulnerability CVE-2020-1472, discovered in 2020, has continued to be exploited by actors such as Conti and Darkside during the first half of 2021. This interest for vulnerabilities demonstrated by threat actors is largely supported by our SOC operations as in 15,496 detections in 2021 \u201cExecution of malicious code attempts\u201d remains one of the most observed one (13%).<\/p>\n<\/div>\n<\/div>\n\n\n\n
Two key statistics highlighted by our SOC<\/a> and CERT reveal that threat actors keep using phishing to get an initial foothold on a network:
\u2013 12% of the incident responses conducted by CERT Intrinsec involved phishing attempts;
\u2013 The incident type \u201cmalicious link\u201d is among the most observed one by our SOC (alongside aggressive port scans, aggressive subnet scans and bruteforce attempts)
This initial access technique is used by threat actors distributing loaders such as Emotet, IceID, Bazar Loader or QakBot. This type of threat continues to target corporates and is often combined with other threats such as the exploitation of known vulnerabilities or ransomware, making them potentially<\/p>\n<\/div>\n\n\n\n<\/figure><\/div>\n<\/div>\n<\/div>\n\n\n\nCybercrime marketplace still going strong<\/h2>\n\n\n\n
33% Vulnerabilities<\/h3>\n\n\n\n
33% Customer Data<\/h3>\n\n\n\n
29% Company Data<\/h3>\n\n\n\n
5% Counterfeit goods \/ services<\/h3>\n\n\n\n
Zero-days and supply chain attacks<\/h2>\n\n\n\n
<\/figure><\/div>\n\n\n\nMost impactful 2021 flaws involving Zero-Day vulnerabilities and\/or a supply chain attack<\/h2>\n\n\n\n
<\/a><\/figure><\/div>\n\n\n\n
US intelligence agencies formally accuse Russia of association with the SolarWinds attack that dates back in September 2019<\/p>\n\n\n\n<\/figure>\n\n\n\n
Accellion releases a latest patch based on IR mandiant report fixing a series of 0-day vulnerabilities affecting Accellion File Transfer Appliance compromised that started back in December 2020;<\/p>\n\n\n\n<\/a><\/figure>\n\n\n\n
Mass exploitation of Microsoft on-prem Exchange RCE dubbed Proxylogon. Indications of retroactive exploitation dating back two weeks<\/p>\n\n\n\n
Beyond the intelligence gathering from emails, the latter were abused for hijack existing email threads by the infamous Emotet botnet<\/p>\n<\/div>\n<\/div>\n\n\n\n
![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2022\/02\/image-25.png\")
<\/a><\/figure><\/div>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2022\/02\/image-26.png\")
<\/a><\/figure>\n\n\n\n