"Researchers Identify 223 Vulnerabilities Used in Recent Ransomware Attacks"

Researchers from RiskSense have identified 223 different IT security vulnerabilities in the Common Vulnerabilities and Exposures (CVE) database that were exploited in the performance of ransomware attacks in 2020. The number of vulnerabilities used in ransomware attacks in 2020 is four times the number of ransomware-related vulnerabilities discovered by RiskSense in 2019. The researchers have also brought further attention to the significant growth and increasing complexity of ransomware families, comparing the discovery of 19 separate ransomware families in 2019 with the identification of at least 125 ransomware groups in 2020. According to researchers, these groups are continuing to expand their operations, develop new malware strains, sell their tools to other malicious parties, and targeting flaws contained by software and web applications. Nearly 40 percent of the 223 CVEs, tied to attacks involving ransomware in 2020, fall under five commonly identified security vulnerabilities, which include permissions, privileges and access controls, code injection, incorrect input validation, improper limitation of operations within the bounds of a memory buffer, and the exposure of sensitive information to unauthorized users. The driving factors behind this expanded attack surface appear to be the transition of businesses into an online model due to the COVID-19 pandemic, as well as developments in digital transformation and the increase in cloud adoption. These factors have pushed many organizations to adopt technologies such as cloud applications, Virtual Private Networks (VPNs), and home networks, with security flaws and misconfigurations that could be abused in ransomware attacks. This article continues to discuss RiskSense researchers' identification of 223 distinct vulnerabilities used in recent ransomware attacks, the factors behind this increase in ransomware-related vulnerabilities, the growing sophistication of ransomware families, and how organizations can improve their ransomware defense. 

SC Media reports "Researchers Identify 223 Vulnerabilities Used in Recent Ransomware Attacks"