{"id":34017,"date":"2022-06-02T17:14:43","date_gmt":"2022-06-02T14:14:43","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=34017"},"modified":"2026-03-28T00:59:33","modified_gmt":"2026-03-27T21:59:33","slug":"r4iot-when-ransomware-meets-the-internet-of-things","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/r4iot-when-ransomware-meets-the-internet-of-things\/","title":{"rendered":"R4IoT: When Ransomware meets the Internet of Things"},"content":{"rendered":"\n

by Vedere Labs<\/em><\/p>\n\n\n\n

Over the past few years\u2019 ransomware has been evolving because of two ongoing trends: <\/p>\n\n\n\n

1. digital transformation driving rapid growth in the number of IoT devices in organizations<\/p>\n\n\n\n

2. the convergence of IT and OT networks. <\/p>\n\n\n\n

\"Forescout_R4IoT_ssict_800_884\"<\/a><\/figure>\n\n\n\n

Ransomware actors have been evolving quickly and have moved from purely encrypting data until circa 2019 to exfiltrating data before encryption in 2020 to large extortion campaigns with several phases in 2021. The trend continued in early 2022 with the emergence of new and very sophisticated ransomware families such as\u00a0ALPHV<\/a>\u00a0and more attacks by ransomware-as-a-service gangs such as\u00a0Conti<\/a>. This evolution in attacker methods means that ransomware gangs could now cripple the operations of virtually any organization.\u00a0<\/p>\n\n\n\n

Today, Forescout\u2019s Vedere Labs is releasing an\u00a0information report<\/a>\u00a0that includes a detailed playbook describing how organizations can protect themselves against a new type of ransomware attack that leverages IoT devices, such as video cameras, to deploy ransomware. The report includes a comprehensive, proof-of-concept demonstration of this new attack vector which Vedere Labs predicts will be the next step in ransomware evolution \u2013 we call this new attack approach\u00a0\u201cRansomware for IoT\u201d<\/a>\u00a0or R4IoT. The R4IoT report describes how IoT devices can be exploited for initial access and lateral movement to IT and OT devices, with the objective of causing physical disruption of business operations.\u00a0<\/p>\n\n\n\n

The proof-of-concept ransomware described in the R4IoT report exploits the first trend by using exposed vulnerable devices, such as an IP video camera or a network-attached storage (NAS) device, as the initial access point to the network, and the second trend to hold OT devices hostage, thus adding another layer of extortion to an attack campaign. <\/p>\n\n\n\n

This research is the first of its kind because:<\/p>\n\n\n\n