Incident : ransomware

VIN0962109103025

Exposure Impact

Title: Global Ransomware Surge in September 2023

Description: NCC Group's latest report found that global ransomware attacks increased sharply by 28% in September 2023, reaching 421 incidents. This surge followed a six-month decline, with the Industrials sector (29% of attacks) being the most targeted, followed by Consumer Discretionary (76 attacks) and Financial institutions (47 attacks). North America and Europe accounted for 75% of incidents. The Qilin ransomware gang was responsible for 14% of attacks, while new groups like The Gentlemen and Interlock emerged. Geopolitical tensions, including Russian military drills and Middle East conflicts, contributed to the volatile threat landscape. Critical infrastructure, such as European airports, faced significant disruptions due to manual operations and delays.

Date Detected: 2023-09-01

Date Publicly Disclosed: 2023-10-01

Type: ransomware

Attack Vector: phishingexploiting vulnerabilitiessupply chain compromisesthird-party breachescookie hijacking

Threat Actor: Qilin (14% of attacks)The Gentlemen (emerging group)Interlock (emerging group)Unspecified state-affiliated actors (geopolitical context)

Motivation: financial gainoperational disruptiongeopolitical influencestrategic hybrid warfare

Incident : ransomware VIN0962109103025

Entity Name: Unspecified European Airports

Entity Type: Critical Infrastructure

Industry: Transportation

Location: Europe

Customers Affected: True

Incident : ransomware VIN0962109103025

Entity Name: Industrials Sector Organizations (120 attacks in September)

Entity Type: Manufacturing, Supply Chain, Industrial

Industry: Industrials

Location: North AmericaEuropeGlobal

Incident : ransomware VIN0962109103025

Entity Name: Consumer Discretionary Sector (76 attacks in Q3)

Entity Type: Retail, Automotive, Leisure

Industry: Consumer Discretionary

Location: North AmericaEuropeGlobal

Customers Affected: True

Incident : ransomware VIN0962109103025

Entity Name: Financial Institutions (47 attacks in Q3)

Entity Type: Banks, Investment Firms, Insurance

Industry: Financial Services

Location: North AmericaEuropeGlobal

Customers Affected: True

Incident : ransomware VIN0962109103025

Third Party Assistance: Ncc Group (Reporting), Unspecified Cybersecurity Firms.

Recovery Measures: Manual operations in airportsPublic advisories

Communication Strategy: NCC Group reportMedia coverageExpert warnings (e.g., Matt Hull, NCC Group)

Incident : ransomware VIN0962109103025

Type of Data Compromised: Financial data, Customer data, Operational data, Supply chain data

Sensitivity of Data: High (financial, PII, operational)

Data Encryption: True

Incident : ransomware VIN0962109103025

Ransomware Strain: QilinThe GentlemenInterlockUnspecified strains

Data Encryption: True

Data Exfiltration: True

Incident : ransomware VIN0962109103025

Lessons Learned: Ransomware attacks surged after a six-month decline, indicating volatility in threat trends., Industrials and critical infrastructure remain high-priority targets due to operational disruption potential., Geopolitical tensions (e.g., Russia, China, Middle East) are increasingly tied to cyber operations, including ransomware., Emerging ransomware groups (e.g., The Gentlemen, Interlock) leverage shared infrastructure and leaked tools to scale quickly., Third-party and supply chain risks are critical attack vectors, especially during high-activity periods (e.g., Black Friday, Christmas)., AI-enabled ransomware and cookie hijacking are emerging threats exacerbated by geopolitical instability.

Incident : ransomware VIN0962109103025

Recommendations: Implement robust third-party risk management to mitigate supply chain and vendor compromises., Enhance incident response plans with rapid detection and containment protocols., Adopt proactive security strategies, including threat intelligence sharing and red teaming., Prioritize critical infrastructure protection, especially in transportation and retail sectors., Monitor geopolitical developments for potential cyber threat correlations (e.g., hybrid warfare)., Prepare for seasonal spikes in attacks (e.g., holiday shopping periods) with heightened vigilance., Invest in AI-driven threat detection to counter evolving ransomware tactics.Implement robust third-party risk management to mitigate supply chain and vendor compromises., Enhance incident response plans with rapid detection and containment protocols., Adopt proactive security strategies, including threat intelligence sharing and red teaming., Prioritize critical infrastructure protection, especially in transportation and retail sectors., Monitor geopolitical developments for potential cyber threat correlations (e.g., hybrid warfare)., Prepare for seasonal spikes in attacks (e.g., holiday shopping periods) with heightened vigilance., Invest in AI-driven threat detection to counter evolving ransomware tactics.Implement robust third-party risk management to mitigate supply chain and vendor compromises., Enhance incident response plans with rapid detection and containment protocols., Adopt proactive security strategies, including threat intelligence sharing and red teaming., Prioritize critical infrastructure protection, especially in transportation and retail sectors., Monitor geopolitical developments for potential cyber threat correlations (e.g., hybrid warfare)., Prepare for seasonal spikes in attacks (e.g., holiday shopping periods) with heightened vigilance., Invest in AI-driven threat detection to counter evolving ransomware tactics.Implement robust third-party risk management to mitigate supply chain and vendor compromises., Enhance incident response plans with rapid detection and containment protocols., Adopt proactive security strategies, including threat intelligence sharing and red teaming., Prioritize critical infrastructure protection, especially in transportation and retail sectors., Monitor geopolitical developments for potential cyber threat correlations (e.g., hybrid warfare)., Prepare for seasonal spikes in attacks (e.g., holiday shopping periods) with heightened vigilance., Invest in AI-driven threat detection to counter evolving ransomware tactics.Implement robust third-party risk management to mitigate supply chain and vendor compromises., Enhance incident response plans with rapid detection and containment protocols., Adopt proactive security strategies, including threat intelligence sharing and red teaming., Prioritize critical infrastructure protection, especially in transportation and retail sectors., Monitor geopolitical developments for potential cyber threat correlations (e.g., hybrid warfare)., Prepare for seasonal spikes in attacks (e.g., holiday shopping periods) with heightened vigilance., Invest in AI-driven threat detection to counter evolving ransomware tactics.Implement robust third-party risk management to mitigate supply chain and vendor compromises., Enhance incident response plans with rapid detection and containment protocols., Adopt proactive security strategies, including threat intelligence sharing and red teaming., Prioritize critical infrastructure protection, especially in transportation and retail sectors., Monitor geopolitical developments for potential cyber threat correlations (e.g., hybrid warfare)., Prepare for seasonal spikes in attacks (e.g., holiday shopping periods) with heightened vigilance., Invest in AI-driven threat detection to counter evolving ransomware tactics.Implement robust third-party risk management to mitigate supply chain and vendor compromises., Enhance incident response plans with rapid detection and containment protocols., Adopt proactive security strategies, including threat intelligence sharing and red teaming., Prioritize critical infrastructure protection, especially in transportation and retail sectors., Monitor geopolitical developments for potential cyber threat correlations (e.g., hybrid warfare)., Prepare for seasonal spikes in attacks (e.g., holiday shopping periods) with heightened vigilance., Invest in AI-driven threat detection to counter evolving ransomware tactics.

Incident : ransomware VIN0962109103025

Source: NCC Group Ransomware Report (Q3 2023)

URL: https://www.nccgroup.com/

Date Accessed: 2023-10-01

Incident : ransomware VIN0962109103025

Source: Matt Hull, Head of Threat Intelligence at NCC Group

Date Accessed: 2023-10-01

Incident : ransomware VIN0962109103025

Investigation Status: Ongoing (trend analysis by NCC Group)

Incident : ransomware VIN0962109103025

Stakeholder Advisories: Organizations Urged To Act Against Rising Ransomware Threats (Ncc Group)., Warning About Geopolitical Cyber Risks (E.G., Russian Drills, Middle East Tensions)., Advisory On Holiday-Season Attack Surges (Black Friday, Christmas)..

Customer Advisories: Potential delays and disruptions in transportation (e.g., airports) due to ransomware.Increased risk of data breaches in retail and financial sectors.

Incident : ransomware VIN0962109103025

Entry Point: Phishing, Vulnerable Third-Party Vendors, Supply Chain Compromises, Stolen Credentials,

High Value Targets: Industrials, Financial Institutions, Critical Infrastructure (E.G., Airports),

Data Sold on Dark Web: Industrials, Financial Institutions, Critical Infrastructure (E.G., Airports),

Incident : ransomware VIN0962109103025

Root Causes: Exploitation Of Unpatched Vulnerabilities In Third-Party Systems., Lack Of Adaptive Security Measures For Emerging Threats (E.G., Ai-Enabled Ransomware)., Geopolitical Tensions Enabling State-Affiliated Or Tolerated Cyber Operations., Insufficient Segmentation Of Critical Infrastructure Networks.,

Corrective Actions: Strengthen Third-Party Vendor Security Assessments., Deploy Behavioral Analysis Tools To Detect Anomalous Activity (E.G., Ransomware Encryption Patterns)., Enhance Cross-Sector Collaboration For Threat Intelligence Sharing., Conduct Regular Red Team Exercises To Test Incident Response Readiness., Implement Zero-Trust Architectures To Limit Lateral Movement In Breaches.,