• 57% increase in ransomware attacks on organizations CPR tracks within the last 6 months. Since the advent of 2021, ransomware attacks have grown 9% each month
• Number of cyber attacks on Microsoft Exchange servers tripled in the last week alone, bringing the total number of attacks on Microsoft Exchange servers documented by CPR to over 50,000
• WannaCry is trending again, as CPR finds the number of organizations affected by WannaCry has increased by 53%
• USA sees the most ransomware (12% of all ransomware attack attempts) and Microsoft Exchange server attacks (49% of all Microsoft Exchange server attack attempts), compared to other countries

Check Point Research (CPR) is observing global surges in ransomware attacks, alongside an increase in cyber attacks targeting vulnerabilities in Microsoft Exchange Servers. The revelation comes at a time where CISA has raised alarm bells about ransomware attacks against Microsoft Exchange servers, in addition to other security researchers who have already detected at least two groups leveraging Microsoft Exchange vulnerabilities to infect victims with ransomware – ransomware group BlackKingdom and another unknown group deploying a new malware strain called DearCry.

Global Surges in Ransomware

Recently, CPR has spotted the following trends and data around ransomware attacks based on organizations it tracks:

• Since October 2020, there has been a 57% increase in the number of organizations affected by ransomware globally
• Since the beginning of 2021, the number of organizations affected by ransomware has been growing at 9% month over month
• In the past 6 months, there has been a general increase in the number of attacks involving human-operated ransomware, such as Maze and Ryuk
• In total, 3,868 organizations have been affected

CPR has identified the top 3 countries that saw the most ransomware attack attempts as USA (12%), Israel (8%) and India (7%).

CPR has identified the top 3 industry sectors that saw the most ransomware attack attempts as Government/Military (18%), Manufacturing (11%), Finance/Banking (8%).

Cyber Attacks Targeting Microsoft Exchange Servers Go Up

Recently, CPR has spotted the following trends and data around cyber attacks that have targeted Microsoft Exchange Servers based on organizations it tracks:
• In the last week, the number of attacks involving Exchange Server vulnerabilities has tripled
• Over 50,000 attack attempts has now been documented by CPR on Microsoft Exchange Servers
• The most targeted industries are government/military, manufacturing and then banking/finance.
• The most affected country is the United States (49% of all exploit attempts), followed by the United Kingdom (5%), the Netherlands (4%) and Germany (4%)

WannaCry Trends, Again

WannaCry is trending again. WannaCry is a ransomware worm that spread rapidly through across a number of computer networks in May of 2017. After infecting a Windows computers, it encrypts files on the PC’s hard drive, making them impossible for users to access, then demands a ransom payment in bitcoin in order to decrypt them. CPR has spotted the following trends and data around WannaCry based on organizations it tracks:

• Since the beginning of the year, the number of organizations affected with WannaCry globally has increased by 53%
• There are 40 times more affected organizations in March 2021, when compared to October 2020
• The new samples still use the EternalBlue exploit to propagate

Manager of Threat Intelligence, Lotem Finkelsteen:
“Two trends are happening concurrently. One, cyber attacks targeting Microsoft Exchange servers are increasing sharply. Two, ransomware attacks are simultaneously rising steadily. Although we have not concluded that the two trends are directly related just yet, there is reason for concern. We do believe the Microsoft Exchange vulnerabilities opened up another door into organizations. And so, Check Point Research is also raising the alarm bells, just like CISA has. We’re urging organizations to act now, before ransomware gangs make Exchange exploits popular. In cyber crime, we rarely see businesses that demonstrate constant growth, or rapid adjustments to changing factors, as well as quick adoptions of new technologies. Ransomware is one of those rare businesses.”

How Organizations can Protect Against Ransomware
1. Back up all data - One of most important tasks is backing up your company’s data. If something goes wrong, your data should be able to quickly and easily revert to a previous version.
2. Keep software updated - Ransomware attackers sometimes find an entry point within apps and software, noting vulnerabilities and capitalizing on them. Fortunately, some developers actively search for new vulnerabilities and patch them.
3. Utilize better threat detection - Most ransomware attacks can be detected and resolved before it’s too late. To maximize your chances of protection, have an automated threat detection in place in your organization.
4. Adopt multifactor authentication - Multifactor authentication forces users to verify their identities in multiple ways before they’re granted access to a system. This way, if an employee mistakenly gives their password to a cybercriminal, the criminal won’t be able to gain easy access to your systems.
5. Scan and monitor emails and file activity - Emails are a common choice of cybercriminals executing phishing schemes, so take the time to scan and monitor emails on an ongoing basis, and consider deploying an automated email security solution to block malicious emails from ever reaching users.