Ransomware has quickly become one of the most prevalent cyber threats facing organizations today. Unfortunately, the cybercriminal community has latched onto this attack method because infections can quickly cause devastating damage to the victim, and strikes are incredibly easy to launch at scale. The best way to ensure that your organization does not fall victim to a ransomware attack is to understand what happens when an attacker injects this type of malware into a system.

2021 will go down in the record book as another critical year in the cybersecurity sector, with high-profile ransomware campaigns and supply chain attacks making national headlines. The elite Trustwave SpiderLabs team was in the trenches for our clients around the world -- providing key insights, threat intelligence, and breakthrough research on a wide array of vulnerabilities and malware. Take a journey through some of the most-read research from Trustwave SpiderLabs in 2021.

Recently, we observed a malware spam campaign leveraging the current COVID-19 situation. The emails were sent from a compromised mailbox using a mailer script. The message contains a link leading to a Word document. The email takes advantage of a COVID-19 test mandate as a pretext to lure the unsuspecting user into clicking the link and downloading the document. Figure 1. COVID-19 themed malspam with link to the malicious document.

Ransomware attackers today have the technical skill and tools to analyze a target’s defenses and like a band of guerilla operatives attacking a more power adversary, the attackers avoid the teeth of the defense and hit their victim at its weakest point. All while layering in new tactics to force their victims to pay a ransom. To be prepared for this threat, an organization must have a plan in place to deal with the myriad of new tricks ransomware attackers have developed over the last few years.

Dec. 29: Updated to cover three additional CVEs: CVE-2021-4104, CVE-2021-44832, and CVE-2021-42550 (in logback as opposed to log4j). Dec. 22: A joint Cybersecurity Advisory was issued by multiple national cybersecurity agencies providing mitigation guidance on addressing vulnerabilities in Apache’s Log4j software library: CVE-2021-44228 (known as “Log4Shell”), CVE-2021-45046, and CVE-2021-45105. Dec. 17: Please note the emergency directive from CISA on Log4j.

Dec. 29: Updated to cover three additional CVEs: CVE-2021-4104, CVE-2021-44832, and CVE-2021-42550 (in logback as opposed to log4j). Dec. 22: A joint Cybersecurity Advisory was issued by multiple national cybersecurity agencies providing mitigation guidance on addressing vulnerabilities in Apache’s Log4j software library: CVE-2021-44228 (known as “Log4Shell”), CVE-2021-45046, and CVE-2021-45105. Dec. 17: Please note the emergency directive from CISA on Log4j.

This is part 3 of Trustwave’s 2022 Cybersecurity Predictions blog series brought to you by our APAC team. In 2021, the cybersecurity industry was truly tested. Most notably, we uncovered the deeper fallout from the SolarWinds attacks, combatted the proliferation of advanced ransomware gangs and a surge in vulnerability exploitation, and saw fragile supply chain and critical infrastructure more targeted by attackers than ever.

Mergers and acquisitions are high-risk endeavors, sometimes with billions of dollars and corporate reputations at stake. But one way to help lessen the danger is by conducting a thorough cybersecurity review during the due diligence process. The consulting and professional services team at Trustwave works closely with firms across the globe undertaking M&A deals of all sizes.

Through the active Dark Web research that Trustwave SpiderLabs conducts for its clients, we have observed new communications on various Dark Web forums between Eastern-European cybercriminals. Based on the conversations that we’ve collected, a segment of cybercriminals is now worried that the Russian authorities may be actively hunting them down.