Ransomware Ecosystem

Ransomware has evolved into an ecosystem with multiple players and an expanded threat model. Ransomware groups now deploy a double extortion technique, where they both encrypt and exfiltrate their victims’ data. The Tenable Security Research Team has released a report that enumerates common vulnerabilities exploited by ransomware affiliates and groups. The Ransomware Ecosystem report enables organizations to quickly scan for the vulnerabilities commonly exploited by ransomware groups.

Organizations with effective Business Continuity and Disaster Recovery plans are protected against threats to availability of data, which can come in many forms, such as natural disasters, hardware failures, or malicious attacks. These organizations could recover operations from a traditional ransomware attack without paying the ransom. However, the vulnerabilities that gave ransomware groups the opportunity to successfully penetrate the infrastructure may still leave organizations open to significant risk. Like any good business, ransomware players discovered the advantage of threatening data confidentiality by publishing samples of their targets’ sensitive data and threatening to expose all the data unless they are paid.

Threat actors understand the economic advantage of investing in the ransomware ecosystem, becoming more sophisticated and efficient over time. Organizations often struggle to secure a budget for resources needed to protect their infrastructure and prevent attacks from succeeding.

The Ransomware Ecosystem report displays assets by plugin family along with associated vulnerabilities. Operations teams use this information to evaluate risk based on the organization’s business priorities. The ability to rapidly mitigate vulnerabilities requires data to be presented in a concise manner focused on findings that pose the greatest risk to the organization. Risk managers leverage risk-based vulnerability management platforms to prioritize mitigation efforts.

This report is available in the Tenable.sc Feed, a comprehensive collection of dashboards, reports, Assurance Report Cards, and assets. The report can be easily located in the Tenable.sc Feed under the category Compliance & Configuration Assessments. The report requirements are:

• Tenable.sc 5.18.0
• Nessus 8.14.0

Tenable.sc enables organizations to quickly identify and locate vulnerabilities in their infrastructure.This report displays the most common vulnerabilities sorted by platform type that are commonly exploited by ransomware groups. Security leaders need to SEE everything, PREDICT what matters most and ACT to address cyber risk and effectively align cybersecurity initiatives with business objectives.

Chapters

Executive Summary Chapter – Contains information from the Ransomware Ecosystem Dashboard that uses the CVE and Plugin Family filters to display counts of the vulnerabilities and assets that have been affected by ransomware.

Linux Chapter  – Contains charts and tables that group together Ransomware Ecosystem related CVEs for all Linux Operating Systems and includes an IP Detail for the hosts identified.

Windows Chapter  – Contains charts and tables that group together Ransomware Ecosystem related CVEs for all Windows Operating Systems and includes an IP Detail for the hosts identified.

Other Chapter  – Contains charts and tables that group together Ransomware Ecosystem related CVEs for all "Other" Operating Systems and includes an IP Detail for the hosts identified.