Zero-day, one-day vulnerabilities led to over 200% increase in ransomware attacks: Report

The use of zero-day and one-day vulnerabilities has led to a 204% increase in the number of ransomware attacks between the first quarter of 2022 and 2023 in the Asia-Pacific Japan region, a report has found. Zero-day vulnerabilities are used to refer to the kind of attacks that happen due to a security flaw unknown to the vendor, while the one-day vulnerability is a security weakness that has been detected but not yet patched. 

This report by cloud company Akamai also found that essential manufacturing is an actively targeted sector along with business services, services, construction, retail, energy, utilities, and telecommunication. Exfiltration of files, unauthorised extraction of sensitive information have become the primary source of extortion, making file backup solutions an insufficient ransomware protection strategy. In fact, adversaries are shifting from phishing to vulnerability abuse to deploy ransomware in a business’ internal network, the report said.

LockBit was named the most subscribed ransomware-as-a-service (RaaS) which accounts for 51% of the attacks from from Q3 2021 to Q2 2023 in the APJ region. It is followed by ALPHV and CL0P ransomware groups.

“Businesses — especially SMEs in APJ — must work to adopt a zero trust architecture starting with software-defined microsegmentation in order to effectively mitigate ever-evolving cyber attacks as well as RaaS. By doing so, they can successfully protect their critical assets, business reputation, and ensure business continuity regardless of the type of attack tool deployed by cyber criminal gangs,” said Dean Houari, director of security technology and strategy, Akamai.

Notably, in June, the US Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and other government bodies from the US, Australia, Canada, etc. published a joint bulletin. The agencies called the ‘most globally used and prolific RaaS in 2022 and 2023’, LockBit. The report also stated that approximately $91 million ransom has been paid to the actors behind LockBit in the US alone since January 2020.