瞭解勒索軟體生態系統：從螢幕鎖定程式搖身一變為數百萬美元的犯罪企業
Tenable Research 發表的一份最新報告探討了勒索軟體生態系統中的主要參與者，以及協助他們從菜鳥網路威脅發展成為一股不可忽視的勢力的戰術。
勒索軟體是一種不斷進化的網路威脅，透過持續的革新，勒索軟體不但是只求生存下去，甚至還蓬勃發展。
有許多詳細描述勒索軟體演進的報告，從最早期在 1989 年稱之為 AIDS (or PC Cyborg) 木馬程式的勒索軟體形式，到轉型為螢幕鎖定程式勒索軟體，以及最終成為可加密受害者系統上檔案的加密鎖定程式勒索軟體。這種勒索軟體類型已成為現代勒索軟體運作的基本。
螢幕鎖定勒索軟體仰賴的恐懼戰術，利用像是聯邦調查局 (FBI) 和英國倫敦警察廳 (the Met) 等執法單位的形象針對個別使用者，並以簡訊宣稱被害者曾經從他們的電腦存取色情或虐待兒童的內容。這些受害者會被指示支付「罰款」，通常金額在 $100 - 500 美元之間，這樣才能解鎖他們的系統。事實上，這些使用者不必付款就能重新存取他們的系統，而且他們的檔案一個都沒有被蓄意破壞。
過去四年來，勒索軟體已快速成長為高達數百萬美元且自給自足的產業。自 2021 年針對重大基礎設施而受到矚目的 Colonial Pipeline 或 JBS Foods 攻擊後，它已成為企業日常體驗的一部份。
圖片來源： Security Boulevard
支撐今日勒索軟體成功大業的就是所謂的勒索軟體生態系統。在我們最新發表的報告中，我們探討了組成勒索軟體生態系統的主要參與者，以及協助勒索軟體成為如今企業最主要威脅所使用的戰術。
您在這份報告中將瞭解到：
- 勒索軟體生態系統的演進
- 在此生態系統中參與者最常利用的攻擊媒介
- 如何準備與抵禦勒索軟體攻擊的指引
- 在勒索軟體攻擊中可能會被刺探利用的弱點清單
取得更多資訊
- 由此下載完整報告
- 歡迎參加網路研討會：Tenable 的勒索軟體生態系統報告：瞭解主要參與者、最常見的攻擊媒介以及避免您成為受害者的方法
- 關於勒索軟體生態系統 Tenable.io 儀表板的部落格貼文
- 關於勒索軟體生態系統的 Tenable.sc 儀表板部落格貼文
- 關於勒索軟體生態系統的 Tenable.sc 報告部落格貼文
- 在 Tenable Community 上關注 Tenable 安全應變團隊
相關文章
IDC Ranks Tenable No. 1 in Worldwide Device Vulnerability Management Market Share for the Fifth Consecutive Year
February 22, 2024The research firm’s latest report also provides market insights that security professionals can use to improve their vulnerability management strategy.
Pig Butchering Scam: From Tinder and TikTok to WhatsApp and Telegram, How Scammers Are Stealing Millions in a Long Con
February 14, 2024In part one of a two-part series on Pig butchering, we detail the pervasive scam that has impacted thousands of victims around the world, resulting in the loss of hundreds of millions of dollars. This blog highlights the who and the how of Pig butchering scams, and details the Pig butchering playbook.
Pig Butchering Scam: How Bitcoin, Ethereum, Litecoin and Spot Gold (XAUUSD) Investments Are Used in Romance Scams to Steal Hundreds of Millions
February 14, 2024This is the second part of a two-part series based on firsthand research into pig butchering scams from the end of 2022 into early 2024. In this post, we delve into the types of investment scams perpetrated by pig butchers to steal hundreds of millions of dollars from victims, including in the form of cryptocurrency and spot gold.
Cybersecurity Snapshot: Latest MITRE ATT&CK Update Offers Security Insights on GenAI, Identity, Cloud and CI/CD
April 26, 2024Check out what’s new in Version 15 of the MITRE ATT&CK knowledge base of adversary tactics, techniques and procedures. Plus, learn the latest details about the Change Healthcare breach, including the massive scope of the data exfiltration. In addition, why AI cyberthreats aren’t impacting CISOs’ budgets. And much more!
CVE-2024-20353, CVE-2024-20359: Frequently Asked Questions About ArcaneDoor
April 25, 2024Frequently asked questions about CVE-2024-20353 and CVE-2024-20359, two vulnerabilities associated with “ArcaneDoor,” the espionage-related campaign targeting Cisco Adaptive Security Appliances.
CVE-2024-4040: CrushFTP Virtual File System (VFS) Sandbox Escape Vulnerability Exploited
April 23, 2024A zero-day vulnerability in CrushFTP was exploited in the wild against multiple U.S. entities prior to fixed versions becoming available as the vendor recommends customers upgrade as soon as possible.
- Research Reports
- Vulnerability Management