At least 1,500 organisations and individuals feel victim to ransomware globally in the first half of 2023, according to new stats from Rapid7.

Its 2023 Mid-Year Threat Review revealed the top threat actors from the first half of 2023, with familiar names taking top billing.

According to the research, three ransomware gangs were responsible for a majority of the attacks: Lockbit (35.3%), BlackCat or ALPHV (14.2%) and Cl0p (11.9%).

Vulnerabilities 

Rapid7 research discovered new vulnerabilities, but found that the majority of attack vectors were traditional, and methods such as brute force attacks and credential stuffing were still prevalent.

Incident responders at Rapid7 saw a 69% increase in year over year caseload in the first half of 2023.

Nearly four out of ten (39%) incidents seen by Rapid7 in the first half of 2023 were the result of lax or missing enforcement of multi-factor authentication, especially for VPNs.

Vulnerability exploitation (27%) and phishing payloads (13%) were the next most common initial access vectors.

Ransomware Groups

While the top three ransomware gangs in the first half of 2023 have remained stable, new groups are continuing to emerge onto the landscape.

Akira, a ransomware group that reportedly launched just at the end of Q1 2023, has already amassed 60 known victims.

Further, the data collected by Rapid7 does not take into account downstream organisations affected by cyber-attacks, so does not reflect the true impact of these incidents.

Still, the top three gangs appear to be effective – Cl0p just released victim data online after a ransom was not paid.

“Given the publicity and money Cl0p potentially made from the attack, it’s safe to say that ransomware is a threat that here to stay,” Jordan Schroeder, managing CISO at Barrier Networks said. “Criminals are earning millions of dollars from victims, often without even having to take the measures of encrypting data.”

State-Sponsored Attacks and ATP 

The report found 79 known state-sponsored attacks in the first half of 2023.

Of these, 24% targeted public-facing applications to target governments, critical infrastructure, and corporate networks, 23% used spear-phishing, and 22% abused valid accounts to gain access to victim environments.

Advanced Persistent Threat (APT) actors targeted a mix of zero-day and known vulnerabilities in the first half of 2023.

Recommended reading

• Report: Ransomware Attacks Have Doubled Across Key Industries
• Is AI Behind the Rise in Ransomware Threats?
• Cyber-criminals Shifting Methods, Ransomware Surges 74% in Q2

Threat actors targeted routers, print management software, and security appliances – typically staying along network edges to gain access. While also targeting business emails and virtualisation platforms, Voice Over IP (VOIP) solutions were noted as an “underappreciated attack vector,” with Rapid7 expecting to see them targeted more in the future.

Security Guidance

Rapid7 also included some security guidance as the threat of cyber-attacks continually looms.

This includes practical advice like various monitoring protocols for cloud storage access, firewall rules, data transfers, and data archiving.

Alerting or restricting large files uploads and monitoring large volumes of traffic is also recommended to surveil for malicious activity.

Implementing egress filtering and restricting admin privileges are also recommended.

More specific advice includes implementing and hardening organisational multi-factor authentication as this was a leading attack vector.

Keeping a tight hold of network perimeter devices, by putting them on a high-urgency patch cycle, can increase protections from attackers looking to exploit edge devices.

Finally, creating a vulnerability management protocol is vital to properly maintain a robust security system.