Ransomware attacks rose 116% in the first half of 2021

Recent months have seen landmark attacks. Ransomware operators have executed high-impact incidents, on Colonial Pipeline and JBS Foods, on Quanta, Acer, and Kaseya, and demanded higher ransoms.

Ransomware attacks rose 500% between 2018 and 2021 for industrial organisations, with another 116% increase just between January and May of 2021, a new report by Nozomi Networks Labs has found. 

The manufacturing sector was the most affected, with 148% increase in vulnerability disclosures solely affecting that industry. IoT security threats, such as those for IoT security cameras, were also a heightened area of risk. The Labs team disclosed vulnerabilities for Realtek and ThroughTek, while the Verkada breach showed that attackers could use security cameras as an entry point for lateral movement across victims’ networks.

“Colonial Pipeline, JBS and the latest Kaseya software supply chain attack are painful lessons that the threat of ransomware attacks is real,” said Nozomi Networks Co-founder and CTO Moreno Carullo. “Security professionals must be armed with network security and visibility solutions that incorporate real-time threat intelligence and make it possible to quickly respond with actionable recommendations and plans. Understanding how these criminal organisations work and anticipating future attacks is critical as they defend against this unfortunate new normal.”

Rising threats calls for better protection

Nozomi Networks’ latest “OT/IoT Security Report” gives cybersecurity professionals an overview of the OT and IoT threats analysed by the Nozomi Networks Labs security research team. The report found:

• Analysis of DarkSide, REvil and Ryuk highlight the growing dominance of RaaS models.
• ICS-CERT vulnerabilities increased 44% in the first half of 2021.
• Vulnerabilities in the critical manufacturing sector rose 148%.
• The top 3 industries affected included critical manufacturing, a grouping identified as multiple industries, and the energy sector.
• Software supply chain-related vulnerabilities continue to surface – as do medical device vulnerabilities.
• With more than a billion CCTV cameras expected to be in production globally this year, insecure IoT security cameras are a growing concern. The report includes an analysis of the Verkada breach and security vulnerabilities in Reolink cameras and ThroughTek software – discovered by Nozomi Networks Labs.

“As industrial organisations embrace digital transformation, those with a wait and see mindset are learning the hard way that they weren’t prepared for an attack,” said Nozomi Networks CEO Edgard Capdevielle. “Threats may be on the rise, but technologies and practices to defeat them are available now. We encourage organisations to adopt a post-breach mindset pre-breach and strengthen their security and operational resiliency before it’s too late.”