{"id":38700,"date":"2022-12-13T16:11:45","date_gmt":"2022-12-13T13:11:45","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=38700"},"modified":"2026-03-28T02:26:09","modified_gmt":"2026-03-27T23:26:09","slug":"targeted-ransomware-doubled-in-2022-new-techniques-and-groups-emerge","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/targeted-ransomware-doubled-in-2022-new-techniques-and-groups-emerge\/","title":{"rendered":"Targeted ransomware doubled in 2022, new techniques and groups emerge<\/strong>"},"content":{"rendered":"\n

During the first ten months of 2022, the proportion of users attacked by targeted ransomware has almost doubled compared to the same period of 2021. Such a striking growth indicates that ransomware gangs have continued mastering their techniques \u2013 the infamous ones as well as those just entering the scene. Following the developments in the ransomware world, the last crimeware report of 2022 by Kaspersky uncovers new features introduced by the notorious \u201cLockBit\u201d group, and a newcomer, \u201cPlay\u201d that employs of self-propagation techniques.<\/strong><\/p>\n\n\n\n

According to Kaspersky security solutions, the share of users affected by targeted ransomware attacks, accounted for 0.026% of all users attacked by malware in 2022 \u2013 versus 0.016% in 2021. These figures show that cybercriminals are steadily shifting from opportunistic assaults to precisely tailored ransomware attacks to accomplish their goals.   <\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Proportion of users affected by targeted ransomware, by month, January \u2013 October 2022<\/em><\/p>\n\n\n\n

As recent investigations by Kaspersky show, ransomware groups continue to improve their techniques. One of them, Lockbit, remains one of the most popular, innovative and rapidly developing ransomware variants that are currently used. And this group can still ambush cybersecurity specialists by adding new options \u2013 and the practice of credential dumping. This technique means that the actor can take over the infected machine\u2019s domain and create a named pipe to reset the operating system\u2019s credentials.<\/p>\n\n\n\n

Still, there are new ransomware variants that continue to emerge. In the course of 2022, Kaspersky has detected over 21 400 ransomware strains.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Number of new ransomware modifications, by month, January \u2013 October 2022<\/em><\/p>\n\n\n\n

Kaspersky\u2019s most recent discovery is \u201cPlay\u201d, a new highly obfuscated ransomware variant that makes analysis more difficult. Its code bears no resemblance to other ransomware samples \u2013 but luckily Play is in early stages of development. When the investigation was conducted, the location of the leak could not be detected and victims were required to contact the criminals via an email address left in the ransom note. What captivated researchers\u2019 attention was that Play contains a functionality that was recently found in other advanced ransomware variants: self-propagation. First, the attackers find a server message block (SMB) and establish a connection. Next, Play tries to mount the SMB mentioned above and distribute and execute ransomware in the remote system.<\/p>\n\n\n\n

 \u201c<\/em>Ransomware developers keep a close eye on the work of competitors. If one successfully implements a certain functionality, there is a big chance that others will do as well. This makes their ransomware more interesting to their affiliates. The self-propagation of ransomware is a clear example of this. More and more ransomware groups take on inventive techniques that make ransomware attacks even more targeted and destructive \u2013 and this year\u2019s statistics do prove it. <\/em>Another thing we’ll never stop reminding the public of, is the need to make regular backups and store them offline<\/em>,\u201d <\/em>comments Jornt van der Wiel, a security expert at Kaspersky.<\/p>\n\n\n\n

Learn more about the Kaspersky\u2019s latest crimeware report on\u00a0Securelist<\/a>.<\/p>\n\n\n\n

To protect yourself and your business from ransomware attacks, consider following the rules proposed by Kaspersky:<\/p>\n\n\n\n