Cybersecurity firm KELA has issued an interesting report that claims to identify what type of victim ransomware gangs are looking for and offer insight into the dark inner workings of a criminal mind.
Ransomware gangs are looking for the following when hunting for targets:
- The company MUST be based in the US
- The company MUST bring in more than $100 million a year in revenue
- Gangs are NOT interested in businesses in the education, healthcare, government, or non-profit sectors (though, to be honest, I don’t know how many entities in those sectors would be making more than $100 million a year in revenue, I digress. I didn’t write the thing, I”m just relaying the information to you)
- Gangs look primarily for access information (credentials, etc) for RDP and VPN Products from Citrix, Palo Alto Networks, VMware, Fortinet, and Cisco
- They’re willing to pay up to $100,000 to employees of their target company for such access. However, most are only willing to go as high as $57K
Yes, you read that correctly, ransomware gangs are actively PAYING people to sell out their employer! Not only that, they’re being met with success! There are people out there READY and WILLING to do it. The mind boggles. People would be willing to sell out their own employer for $50K plus potentially years in jail and God only knows how much money in legal fees once the Feds, because that’s who’s going to be after you, finally catch up.
KELA does offer some advice regarding what a business can do to protect themselves from such attacks and they’re reprinted below for convenience:
- Cybersecurity awareness and training for all key stakeholders and employees to ensure that key individuals know how to safely use their credentials and personal information online. This cyber training should include specifying how to identify suspicious activities, such as possible scam emails, or unusual requests from unauthorized individuals or email addresses.
- Regular vulnerability monitoring and patching to continually protect their entire network infrastructure and prevent any unauthorized access by Initial Access Brokers or other network intruders.
- Targeted and automated monitoring of key assets to immediately detect threats emerging from the cybercrime underground ecosystem. Constant automated and scalable monitoring of an organization’s assets could significantly improve maintaining a reduced attack surface, ultimately helping organizations thwart possible attempts of cyberattacks against them.
Note that moving your business outside of the United States isn’t listed, nor is how to actually stop an employee from selling their VPN credentials to some Odessa-based, Cheeto encrusted basement dweller. That’s a battle you’ll have to solve on your own apparently.
Like our blog? Subscribe using the CTA in the upper right-hand corner of this page. Feel like sharing your thoughts with us? Use the comment section below.
