The threat landscape has proven to be a very dynamic and evolving space, especially with ransomware. According to the 1H 2022 FortiGuard Labs Threat Landscape Report, there was an almost 100% growth in ransomware variants in half a year. CISOs must keep apprised of the latest threat research to ensure they are implementing the best ransomware prevention and protection solutions. FortiGuard Labs' Derek Manky highlightkey takeaways from the Threat Landscape Report and what CISOs and security teams should pay close attention to in the coming months. 

What are the key findings from the threat report? 

Derek:There are a lot of interesting data points, but some that are top of mind for me when I speak with CISOs are:

• Endpoint:Analyzing endpoint vulnerabilities by volume and detections reveals a relentless path of cyber adversaries attempting to gain access by maximizing both old and new vulnerabilities. While we can never truly predict what criminals will hit next, this gives us a good indicator of where criminals are starting to sniff around and are getting warmer. This is extremely helpful for real-world CISOs to review. See Figure 4 in the report, which shows vulnerabilities that cybercriminals are actively targeting.
• Ransomware:Everyone asks me about the future of ransomware. Our report shows that the ransomware threat continues to adapt with more variants enabled by Ransomware-as-a-Service (RaaS). This is significant because in the past six months, FortiGuard Labs has seen a total of 10,666 ransomware variants, compared to just 5,400 in the previous six-month period. RaaS, with its popularity on the dark web, continues to fuel an industry of criminals forcing organizations to consider ransomware settlements and also protect against evolving techniques.
• Defense Evasion is Top of Mind: Among the top eight tactics and techniques focused on the endpoint, defense evasion was the most employed tactic by malware developers by far. They are attempting to evade defenses by masking them and attempting to hide commands to carry out malicious intent, and in fact adding more and more techniques (ways) that they perform this tactic as we observed in the report. This is significant because this has a direct correlation to how CISOs need to think about their cybersecurity strategies.

Why is wiper malware becoming more common?

Derek: The war in Ukraine fueled a substantial increase in disk wiping malware among threat actors primarily targeting critical infrastructure. We identified at least seven major new wiper variants in the first six months of 2022 that were used in various campaigns against government, military, and private organizations. This number is significant because it is close to the number of wiper variants that have been publicly detected since 2012. Additionally, the wipers did not stay in one geographical location but were detected in 24 countries besides Ukraine and not just Europe. Wiper malware trends reveal a disturbing evolution of more destructive and sophisticated attack techniques continuing with malicious software that destroys data by wiping it clean. This is an indicator that these weaponized payloads are not limited to one target or region, and will be used in other instances, campaigns and targets. I do see this being coupled with cybercrime and ransomware playbooks in the future.

Why are ransomware variants growing? 

Derek: There are three key reasons as to why ransomware variants are growing: 

1. RaaS, with its popularity on the dark web, continues to fuel an industry of criminals.
2. Cyber adversaries continue to invest significant resources into new attack techniques because ransomware is lucrative and still viable.  
3. The primary tactic we see cybercriminals employ is defense evasion -with defense evasion comes more variants.

What ransomware protection and prevention solutions should CISOs consider?

Derek: When CISOs gain a deeper understanding of the goals and tactics used by adversaries through actionable threat intelligence and reports like these, they can better align defenses to adapt and react to quickly changing attack techniques proactively. Also, threat insights are critical to help prioritize patching strategies to better secure environments. These insights can also inform cybersecurity awareness and training which are also important as the threat landscape changes to keep employees and security teams up-to-date.

From a cybersecurity technology perspective there are a few things that come to mind, but overall mature AI and ML are key to combat the rate of exploit today.

• Real-time visibility, protection, and remediation coupled with zero-trust network access (ZTNA) and advanced endpoint detection and response (EDR) are critical. Advanced endpoint technology can help mitigate and effectively remediate infected devices at an early stage of an attack.
• Segmentation is also foundational since it can help limit the spread of an attack and also limit lateral movement which is something we saw in our report as still being a key goal as WFA continues.
• Services such as a digital risk protection service (DRPS) can be used to do external surface threat assessments, find and remediate security issues, and help gain contextual insights on current and imminent threats.
• Network detection and response (NDR) with self-learning artificial intelligence (AI) is helpful to better detect intrusions.
• Integrated, AI and ML-driven cybersecurity platforms with advanced detection and response capabilities powered by actionable threat intelligence are important to protect across all edges of hybrid networks.
• Cybersecurity awareness and training are also important as the threat landscape changes to keep employees and security teams up-to-date.

"When CISOs gain a deeper understanding of the goals and tactics used by adversaries through actionable threat intelligence and reports like these, they can better align defenses to adapt and react to quickly changing attack techniques proactively."

What else should CISOs consider when thinking about ransomware protection and prevention?

Derek: At a high level, cyber adversaries are advancing their playbooks to evade defenses and scale their criminal affiliate networks to maximize opportunities such as RaaS and more. But, they are also using aggressive execution strategies such as extortion or wiping data as well as focusing on reconnaissance tactics pre-attack to ensure better return on threat investment. Speed, sophistication, and scale are realities CISOs need to address.

Learn more about Fortinet's FortiGuard Labs threat research and intelligence organization and the FortiGuard Security Subscriptions and Services portfolio.