Hong Kong: Cybersecurity company Trend Micro on Thursday predicted that ransomware groups will increasingly target Linux servers and embedded systems over the coming years. Ransomware attacks on Linux systems jumped 75% in 1H 2022 compared to 1H 2021, as per data from Trend Micro Smart Protection Network.
This indicates a double-digit year-on-year (YoY) increase in ransomware attacks on Linux systems in 1H 2022.
According to Tony Lee, Trend Micro’s Head of Consulting, Hong Kong & Macau, new and emerging threat groups continue to evolve their business model, focusing their attacks with even greater precision.
“That’s why it’s essential that organisations get better at mapping, understanding, and protecting their expanding digital attack surface. A single, unified cybersecurity platform is the best place to start,” said Lee.
According to the data from Trend Micro 2022 Midyear Roundup Report
- 63 billion threats blocked by Trend Micro in 1H 2022
- 52% more threats in the first half of the year than the same period in 2021
- Government, manufacturing and healthcare were the top three sectors targeted by malware
Detection of attacks from ransomware-as-a-service surged in the first half of 2022. Major players like LockBit and Conti were detected with a 500% YoY increase and nearly doubled the number of detections in six months, respectively. The ransomware-as-a-service model has generated significant profits for ransomware developers and their affiliates.
New ransomware groups are emerging all the time. The most notable one in the first half of 2022 is Black Basta. The group hit 50 organisations in just two months. Many persist with the “big game-hunting” of large enterprises, although SMBs are an increasingly popular target.
One of the primary attack vectors for ransomware is vulnerability exploitation. Trend Micro‘s Zero Day Initiative published advisories on 944 vulnerabilities in the period, a 23% YoY increase. The number of critical bug advisories published soared by 400% YoY.
APT groups continue to evolve their methods by employing expansive infrastructure and combining multiple malware tools. The ten-fold increase in the number of detections is another proof point that threat actors are increasingly integrating Emotet as part of their elaborate cybercrime operations.
The concern is that threat actors are able to weaponize these flaws faster than vendors can release patch updates and/or customers can patch them.
Unpatched vulnerabilities add to a growing digital attack surface many organisations are struggling to manage securely as the hybrid workplace expands their IT environment. Over two-fifths, (43%) of global organisations believe it is “spiralling out of control.”