How threat actors target specific industries with ransomware attacks

Security provider Barracuda analyzed BlackMatter, Karakurt and LockBit to illustrate how threat actors carry out ransomware attacks.

BlackMatter uses phishing emails to compromise employee accounts and gain network access. Once they have gained access, they scan and move laterally within the network while they install hacking tools and steal sensitive data.

Karakurt Data Extortion Group carries out a brutal attack on the VPN login page of an organization after which they compromise several domain controllers and use RDP to access the compromised systems.

LockBit uses stolen login credentials to log in to a company’s VPN login page without MFA. Attackers use malicious PowerShell scripts and install system-level DLLs (dynamic link libraries) to steal additional login credentials and passwords.

According to Barracuda, between January and June 2022, more than 1.2 million ransomware attempts were discovered per month. Ransomware attacks undoubtedly remain a top security problem on a broad front. A careful analysis of ransomware attacks shows, however, that attackers are selective when it comes to industries they target.

According to Barracuda, attacks on municipalities have increased slightly in the last 12 months, while attacks on educational institutions have more than doubled and attacks on health and financial companies have tripled. Also, attacks against critical infrastructure quadrupled over the same time.

Service providers accounted for 14% of the attacks analyzed by Barracuda. Automotive, hospitality, media, retail, software and technology companies have also been targeted in the last 12 months.

The sources for this piece include an article in TechRepublic.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web