Ransomware hacker gangs can no longer rely on critical security flaws, according to a new report shared on Axios.

The report, titled "The Ransomware Threat Landscape: What to Expect in 2024," is a comprehensive analysis by Symantec, the threat intelligence team at semiconductor manufacturer Broadcom.

Faced with the success of law enforcement actions over the past year, these bad actors are adapting.

They are turning to so-called zero-day vulnerabilities to launch their attacks. 

Open-Source AGI: Zuckerberg Raises Concerns Among Experts - USA Herald

Data Privacy Watchdog: Amazon Logistics Fined $35 Million Over Employee Surveillance in France - USA Herald

StarWatchers: The Wolf Moon Appears to Illuminate the Night Sky - USA Herald

AI Taking Jobs: MIT Researchers Claim it will be Incremental - USA Herald

Ransomware Hacker Gangs 

Hackers are shifting tactics since they can no longer rely on critical security flaws. The report highlights their use of zero-day vulnerabilities, driven in part by the effective takedowns of botnets by law enforcement. The vulnerability-heavy attack cycle, which has worked for hacker gangs in the past will be more challenging in 2024. 

Large networks and systems within organizations are becoming more efficient with cybersecurity. And hackers are trying to adapt and rebuild their tools.

As organizations increasingly patch their systems, including popular services like Citrix and Microsoft Exchange, the reliance on zero-day flaws is expected to decrease. 

Vikram Thakur, Technical Director at Symantec, notes that unless new vulnerabilities emerge, the trend may revert to hackers relying on botnets for ransomware attacks.

Targeting Botnets 

Historically, ransomware attacks leveraged botnets found within networks of malware-infected computers. But law enforcement efforts in 2023 have targeted and dismantled some of the most prolific botnets, forcing hackers to adapt and develop backup plans.

Hackers have demonstrated increased adaptability, exploring alternative avenues such as the darknet market, which was previously the domain of nation-state hackers.

 The report highlights the motivation for hackers to find vulnerabilities in public-facing infrastructure used by organizations, leading to more zero-days being disclosed in critical software.

While malware-infected computers in a botnet can be detected and removed by virus-scanning tools within 24 hours, zero-days operate stealthily.

 By the time a company identifies these vulnerabilities, hackers may have already exploited them, leaving affected customers with zero days to patch before potential cyberattacks.

Defense Strategies

Ransomware has become endemic for companies, and hackers are quick to adapt to the tools available in a network. 

Symantec recommends that organizations align their defenses against hacking groups' tools, tactics, and procedures rather than focusing solely on the specific strain of ransomware being used.

To counter the evolving threat landscape, organizations are urged to audit administrative tools used across their networks.

 IT teams should ensure the necessity and proper security measures for each tool. Broadcom emphasizes the need for proactive defense strategies aligned with the dynamic tactics employed by ransomware hacker gangs.

As the cybersecurity landscape continues to evolve, understanding the changing tactics of ransomware hacker gangs is crucial for organizations to fortify their defenses. The report serves as a guide for IT teams, urging them to be prepared, adaptive, and proactive in the face of relentless cyber threats.