Discover more from ESSGroup
Subscribe to get the latest posts sent to your email.
The year 2024 has seen a significant rise in ransomware attacks targeting organizations across various sectors. This report provides an in-depth analysis of the ransomware incidents reported throughout the year, highlighting key metrics and analytics to help understand the scope and impact of these cyber threats.
Month | Number of Attacks |
---|---|
January | 7 |
February | 24 |
March | 8 |
April | 9 |
May | 5 |
June | 3 |
July | 1 |
August | 0 |
September | 1 |
October | 0 |
November | 0 |
December | 0 |
Sector | Number of Attacks |
---|---|
Business Services | 21 |
Technology | 16 |
Manufacturing | 11 |
Transportation/Logistics | 7 |
Government (Religious Organization) | 3 |
Ransomware Group | Number of Attacks |
---|---|
Lockbit3 | 23 |
Blackbasta | 20 |
8base | 10 |
Rhysida | 2 |
Unsafe | 2 |
Sector | Total Data Compromised (GB) |
---|---|
Business Services | 15,600 |
Technology | 9,800 |
Manufacturing | 7,200 |
Transportation/Logistics | 3,400 |
Government (Religious Organization) | 500 |
The year 2024 has been marked by a surge in ransomware attacks, affecting organizations across various sectors. By understanding the key metrics and analytics presented in this report, organizations can better prepare and protect themselves against these evolving cyber threats. Enhanced cybersecurity measures, incident response plans, and collaboration with authorities are crucial steps in mitigating the impact of ransomware attacks.
Subscribe to get the latest posts sent to your email.
Lorem Ipsum is simply dummy text of the printing and typesetting
industry. Lorem Ipsum has been the industry's
Threat Overview
A sophisticated phishing campaign targeting mobile devices has been discovered, hiding malicious links within PDF files using an advanced obfuscation technique. Disguised as documents from the United States Postal Service (USPS), this novel attack exploits users’ trust in PDF documents and employs social engineering tactics for widespread impact across over 50 countries.
Attack Summary
Attack Methodology
The attackers use multilingual support and encryption techniques to expand their reach, making it difficult for security solutions to detect the malicious links hidden within PDF files.
Recommendations
Mitigation Steps
Threat Overview
The Security Operations Center (SOC) has identified a significant and alarming threat report published by AlienVault on April 10, 2025. The report details the activities of the Chinese eCrime group known as Smishing Triad, which has launched an extensive global SMS phishing campaign targeting over 121 countries across various industries.
The campaign’s infrastructure is highly sophisticated and capable of generating over one million page visits in just 20 days, averaging approximately 50,000 daily visits. This level of activity underscores the scale and reach of the Smishing Triad’s operations.
One of the most concerning aspects of this threat report is the introduction of a new phishing kit named ‘Lighthouse.’ This kit is specifically designed to target banking and financial organizations, with a particular focus on institutions in Australia and the Asia-Pacific region. The Lighthouse phishing kit represents a significant evolution in the group’s tactics, techniques, and procedures (TTPs), making it more challenging for traditional security measures to detect and mitigate.
The Smishing Triad claims to have over 300 front desk staff worldwide supporting their operations, which highlights the extensive resources at their disposal. This global workforce enables them to conduct highly coordinated and synchronized attacks across multiple time zones and regions.
Domain Rotation
Another notable tactic employed by the Smishing Triad is frequent domain rotation. The group uses approximately 25,000 active domains during any 8-day period. This rapid rotation of domains makes it difficult for security teams to blacklist or block phishing sites effectively. The majority of these phishing sites are hosted by prominent Chinese companies Tencent and Alibaba, which further complicates efforts to disrupt their operations.
Targeted Sectors
The campaign primarily targets several critical sectors, including postal services, logistics, telecommunications, transportation, finance, retail, and public services. These industries are essential for the functioning of modern economies, making them high-value targets for cybercriminals seeking financial gain or disruption.
Recommendations for Mitigation
In light of this threat report, it is crucial for organizations to take proactive measures to protect themselves against SMS phishing attacks. The following recommendations can help enhance security posture and mitigate the risks associated with the Smishing Triad’s activities:
Domain Monitoring: Use domain monitoring tools to detect and block newly registered domains associated with phishing campaigns. Regularly update blacklists and whitelists based on the latest threat intelligence.
Email and SMS Filtering: Deploy advanced email and SMS filtering solutions that can identify and quarantine suspicious messages before they reach end-users. These solutions should be regularly updated with the latest threat signatures and heuristics.
Incident Response Plan: Develop and maintain an incident response plan specifically tailored to handle phishing attacks. This plan should include steps for containment, eradication, and recovery, as well as communication protocols for notifying affected parties.
Collaboration with ISPs: Work closely with Internet Service Providers (ISPs) to block access to known phishing sites. Regularly share threat intelligence and collaborate on efforts to disrupt the infrastructure supporting these campaigns.
User Awareness Campaigns: Launch awareness campaigns to inform users about the risks of SMS phishing and best practices for staying safe online. Encourage users to report any suspicious messages or activities to the SOC for further investigation.
Regular Security Audits: Conduct regular security audits and penetration testing to identify vulnerabilities in the organization’s infrastructure. Address any identified issues promptly to reduce the attack surface available to cybercriminals.
By implementing these recommendations, organizations can significantly enhance their resilience against SMS phishing attacks and protect themselves from the evolving threats posed by groups like the Smishing Triad.
Subscribe now to keep reading and get access to the full archive.