Ransomware has fast become the dominant form of malware as it makes the most profit for gangs, according to new research.
Cisco's 2016 Midyear Cybersecurity Report found that fragile infrastructure, poor network hygiene, and slow detection rates are the main reasons this type of malicious attack is effective.
The networking firm said it expects the upward trend in ransomware to continue with even more destructive variants that can spread by themselves and hold entire networks and companies hostage appearing.
It said new modular strains of ransomware will be able to quickly switch tactics to maximise efficiency and future ransomware attacks will evade detection by being able to limit CPU usage and refrain from command-and-control actions.
The report also found a growing number of ransomware attacks using server vulnerabilities specifically within JBoss servers of which, 10 per cent of those connected to the internet worldwide were found to be compromised. Many of the JBoss vulnerabilities used to compromise these systems were identified five years ago, meaning that basic patching and vendor updates could have easily prevented such attacks, according to Cisco.
Cyber criminals are also getting better at keeping a low profile when carrying out ransomware attacks, with an increased use of cryptocurrency, Transport Layer Security and Tor, which enables anonymous communication across the web.
The report said many companies do a lousy job of keeping software up to date as a means of defending against ransomware attacks. It reported that 20-25 per cent of Chrome users were on the latest version of the browser, and Java sees slow migrations with one-third of the systems examined running Java SE 6, which is being phased out by Oracle (the current version is SE 10).
In Microsoft Office 2013, 10 per cent or less of users are using the newest service pack version.
"As organisations capitalise on new business models presented by digital transformation, security is the critical foundation. Attackers are going undetected and expanding their time to operate. To close the attackers' windows of opportunity, customers will require more visibility into their networks and must improve activities, like patching and retiring ageing infrastructure lacking in advanced security capabilities," said Marty Roesch, vice president and chief architect of the Security Business Group at Cisco.
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the lastNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field dayNews February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
-
The Zservers takedown is another big win for law enforcementNews LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
