According to Expel, a managed detection and response (MDR) company, the majority of ransomware assaults in 2021 will be self-installed.
The revelation was made in the company’s first annual report on cybersecurity trends and predictions, Great eXpeltations, which was released on Thursday.
Eight out of ten ransomware outbreaks were caused by victims unwittingly opening a zipped file containing malicious code, according to researchers. 3 percent of all ransomware cases were produced via abusing third-party access, while 4% were caused by exploiting a software weakness on the perimeter.
The research was based on an examination of data gathered from Expel’s security operations centre (SOC) for occurrences that occurred between January 1 and December 31, 2021.
Other noteworthy results included the fact that BEC (business email hack) efforts accounted for 50% of instances, with SaaS apps being the most common target.
Expel also found that 35 percent of web app hacks resulted in the deployment of a crypto miner.
Expel proposed establishing network layer controls to detect and limit network traffic to crypto mining pools in 2022, as well as validating event data recorder (EDR) coverage across all endpoints, to protect against risks.
Computing resource alarms should also be forwarded to a security information and event management (SIEM) software solution to highlight overburdened resources that could be used for crypto-jacking, according to the company.
Other recommendations included defending Windows’ self-installation attack surface, putting MFA everywhere, particularly for remote access, patching and updating on a regular basis, and deploying EDR policies in block mode.
More than 90% of the attacks targeted Microsoft Office 365, with attacks against Google Workspace accounting for less than 1% of all events. Okta was the objective of the remaining 9%.
Ransomware was responsible for 13% of all opportunistic attacks. Legal services, communications, financial services, real estate, and entertainment were the top five industries attacked, in that order.
RDP (remote desktop protocol) should not be exposed directly to the internet, according to users.
On Thursday, Expel CEO Dave Merkel stated, “We started Expel with the purpose of bringing more transparency to security.”
“Today, we hit a new milestone in that commitment — we’re publishing the most important threats and trends discovered by our SOC last year, as well as their recommendations for how to address them.”
 company, the majority of ransomware assaults in 2021 will be self-installed.){kind=link}