February was the worst month for ransomware attacks - and a threat group had a field day

February 2025 was the worst month for the number of ransomware attacks, according to new investigations by Bitdefender.

According to analysis of the security company, the volume of the ransomware attacks reached 962 last month and marked a significant increase in the previous year, in which 425 attacks were recorded.

Of these, 335 were used three times as many by the ransomware as service (RAAS) -Grup (ransomware) as in the previous month.

Instead of concentrating on certain companies or industries, some ransomware groups such as Clop are pursuing an opportunistic approach by targeting newly discovered software weak spots on EDGE network devices.

In particular, these groups of weaknesses use high risk scores (Common Nulnerability Scoring System) (CVSS) with high risk scores (COVSS) that enable the attackers to control a system by remote code execution (RCE).

They are also based on defects that affect the Internet -related systems and software, as well as cases in which the proof of the concept of exploitation has already been published by a developer or malicious actor.

“In less than 24 hours after public disclosure of vulnerability, automated scanners that scan the Internet and determine a distant access to endangered systems,” said the researchers.

“After this first access flash, the second stage of the attack – the manual hacking of the victims. This second stage takes time. Attackers have to find out which systems are worth their effort, and then they have to manually chop them down and typically live from the agricultural techniques to escape detection.”

This delay means that the actual ransomware attack or data theft will probably take place weeks or even months later.

Ransomware attacks do not let go

In the past five years, Clop has attacked weaknesses in the Accellion File Transfer Appliance (FTA), whereby government agencies and universities are hit.

Two years ago, there was a mistake in the “Goanyther Managed File Transfer) software in Help system that violates health, financial and production organizations.

In January of this year, the group claimed to achieve almost 60 companies via weaknesses in the Cleo Enterprise File File Transfer software.

“In Clop's case, our analysis of the exploitation of two recent weak points in the CLEO file transfer software, CVE-2024-50623 and CVE-2024-55956.

“Although these vulnerabilities were unveiled in October and December 2024, the manual part of the attack takes time, which can explain why we see these victims now.”

According to Bitdefender, organizations should prioritize patches for actively exploited vulnerabilities and keep up to date via the CISA KEV catalog via well -known heroic deeds. A flexible patching strategy is the key to quick reaction.

You should proactively search your network for hidden threats and discover the hinters before attackers start their main attack.

Of course, cybersecurity tools play a key role in reducing potential threats from ransomware groups. The company found that advanced identification systems such as the endpoint detection and reaction (EDR) or extended detection and reaction services (XDR) are of crucial importance.

February was the worst month for ransomware attacks – and a threat group had a field day

Related posts:

The Schenectady restaurant ensures this

Messi misses Inter Miamis Concacaf Champions Cup match against Cavalier

Live | Kerala lottery result today: akshaya AK-690 Sunday draw out-out-out-proticket no.