Ransomware

Through the Lens of Threat
and Vulnerability Management

2021

SPOTLIGHT

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Table of Contents
1 Executive Summary

1

Key Findings

2

2 Taking a Risk-Based View of Ransomware Vulnerabilities
Weaponized, Dangerous, and Trending
Growth in Weaponization
Growth in Dangerous Vulnerabilities (RCE/PE Capabilities)
Growth in Vulnerabilities Tied to Ransomware
Growth in Trending/Active Exploits among Vulnerabilities Tied to Ransomware

5
7
7
7
8
8

3 Analyzing Ransomware Vulnerabilities and Risk Factors

9

Analysis of CVSS Scores and Severity Rating System
Low Scoring Vulnerabilities
Older VulnerabilitiesCWE Weaknesses Most Aligned for Ransomware Exploit

10
11
12
15

4 Ransomware Families, APT Groups, and Exploit Kits

16

Ransomware Family Details
APT Groups
Exploit Kits

17
20
22

5 Ransomware as a Service

23

Fast Enablement with No Overhead
Product Categories with Expanding Ransomware Risk
Ransomware Vulnerabilities Impacting Multiple Products

24
25
28

6 Summary29

7 Report Methodology

30

RiskSense VRR (Vulnerability Risk Rating)
CSW’s SecureIn VIQ (Vulnerability Intelligence Quotient)31
312021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

1Executive Summary
Ransomware threats have exponentially
increased. Our research uncovered 223
vulnerabilities tied to these threats; it has nearlyquadrupled since our last report. Ransomware
is also a compounding problem; we have seen
older vulnerabilities continue to be leveraged
alongside newly published vulnerabilities.
We’ve also seen higher adoption and utilizationof these vulnerabilities across the ransomware
families, increasing the overall count of trending
with active exploits in the wild. It’s safe to saythat once a vulnerability is tied to ransomware it
should be considered a high risk exposure point,
regardless of its age.
Mapping vulnerabilities to real-world
ransomware threats, and keeping pace withwhat is evolving, is a challenging cyclicalprocess. Our research aims to bring actionable
information to overworked security teams

trying to cope with their never-ending listof vulnerabilities and remediation actions(applying patches, fixing misconfigurations, andaddressing weakness from coding errors).

For organizations, this report brings to lightthe trends we’ve observed and provides thetechnical perspective of how ransomware
is evolving and where an organization may
have heightened ransomware risk exposure.

RiskSense this year partnered with Cyber
Security Works (CSW), a leader in Attack Surface
Management and an official CVE Numbering
Authority (CNA). This joint effort expands
beyond our previous report providing moredetails and trends that matter when it comes toransomware vulnerability exposure.

Executive Summary1

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Key Findings
Exponential Increase in
Vulnerabilities (CVEs) tied to Ransomware
2020 has been a big year for ransomware attackers and with good reason - these threat
actors had 223 vulnerable exposure points to get into your network. The number of CVEs
that are being used by ransomware have nearly quadrupled since last year. However,
only ten of these CVEs were published in 2020.
In our previous Spotlight Ransomware Report, we presented 57 CVEs tied to 19
ransomware families. This year, we found 223 unique vulnerabilities associated with 125
ransomware families.

Old is Gold for Ransomware

Threat actors continue to leverage older vulnerabilities. 96% of the CVEs we tracked,
that’s 213 out of the total 223, are vulnerabilities that were reported in the US National
Vulnerability Database (NVD) before 2019.
The oldest vulnerability, CVE-2007-1036, dates from 2007 and is associated with theCrypsam (SamSam) ransomware family.

Ransomware Reigning Families, Old Lineage, & Upstarts

We identified 125 ransomware families using a mix of the 223 vulnerabilities tied toransomware threats. Our previous report highlighted 19 ransomware families. While
identifying ransomware families is a moving target, it’s notable that this wild growthshows there are plenty of targets and prosperity in these threat tactics to support thistype of expansion.

Executive Summary2

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Even older ransomware families, such as Cobralocker (2012), Gimemo (2012), Kovter(2012), Lokibot (2012), Lyposit (2012), Reveton (2012), Urausy (2012) Crilock (2013),
Cerber (2016), and Cryptomix (2016), are not showing any signs of retiring.
In fact, CryptoMix -- a family with old lineage with five well known ransomware threats(CLOP, Mole, CryptFIle2, CryptoMix, CryptoMix Revenge) -- is an example of how
individual ransomware families expand their capabilities and sophistication. We foundthis family is utilizing 50 CVEs, the oldest from 2010, and they are also tied to CVE-20201472, a new vulnerability disclosed in 2020.
The upstart is Ryuk, accelerating ransomware to the adversarial masses with aransomware-as-a-service delivery model. They have figured out how to monetize thebusiness of ransomware, providing a code-free way for those wishing to target specificbusinesses or asset types.

New Horizons for Ransomware with Diversified Targets

Ransomware is cleverly looking at diverse targets to infiltrate organizations, moving
up from server operating systems to weaknesses in Web and Application frameworks
and applications themselves. 18 CVEs tied to ransomware are found across 6 major
components in this space: WordPress, Apache Struts, Java, PHP, Drupal, and ASP.net.
We’ve observed popular Open Source and related projects, Jenkins, MySQL, OpenStack,
TomCat, Elasticsearch, OpenShift, JBoss, and Nomad, with 19 vulnerabilities from thisgroup being used by ransomware.
Software as a service (SaaS) as a category had the highest count of vulnerabilities thatwere seen trending with active exploits among ransomware families. This shift shows
how these threats are moving as organizations consume more applications in thismanner. The problem however is that organizations must rely on these service providers
to ensure they are remediating quickly against these threats.

Executive Summary3

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Foundational Code Weaknesses and Predicting Ransomware
40% of the CVEs tied to ransomware are associated with 5 Common Weakness
Enumerations (CWEs):• CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer• CWE-20: Improper Input Validation• CWE-264: Permissions, Privileges, and Access Controls• CWE-94: Improper Control of Generation of Code ('Code Injection')• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
This correlation makes it easy to predict that new vulnerability disclosures with similar
traits will be of interest to ransomware families. Three of these five CWEs are alreadyfound in the 2020 Top 25 Most Dangerous Software Weaknesses (CWE-119, CWE-20,
and CWE-94).
By testing and fixing for these CWEs, application developers and software vendors candecrease the ease in which ransomware can attack and limit the frequency of criticalsecurity patches.

Ransomware Activity in Advanced Persistent Threat Groups

We have added a new focus in this report looking at how specific ransomware is going
beyond weaponized attacks on organizations to being utilized by known adversaries withpotentially broader nefarious motives. We identified 33 unique APT groups commonly
using 65 ransomware exploits.
Our research uncovered ransomware association with nation state actors across theglobe. Of interest is that we can link Russia to nine groups (APT28, Doppel Spider,
Dungeon Spider, GOLD SOUTHFIELD, Pinchy Spider, Sandworm Team, TA505, Turla, andZombie Spider) and China to eight APT Groups (Wizard Spider, Rocke, Naikon, Cycldek,
APT41, APT40, APT10, and APT 1) respectively incorporating ransomware as part oftheir arsenal to launch offensive cyber attacks.

Executive Summary4

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

2

Taking a Risk-Based View ofRansomware Vulnerabilities
Among the thousands of vulnerabilities thatare discovered every year, mapping them toreal-world threat-based information helps
security teams prioritize the patching for themost dangerous vulnerabilities that would
cause the most damage.
This mapping is significant for two reasons.
Firstly, a huge majority of vulnerabilities are
not weaponized; if there is not an exploit,
then the risk is minimal. Secondly, even if avulnerability has an exploit it is only whenthese vulnerabilities are actively being targeted
and used as part of an in-the-wild-attack dothey dramatically increase an organization’srisk exposure.
That’s why our research begins by looking
at three metrics that ultimately will helporganizations prioritize and fix vulnerabilities
that really matter.

• Weaponized Vulnerabilities:
Vulnerabilities that have associatedexploit code that is capable of taking
advantage of the vulnerability• Strategic Vulnerabilities: Vulnerabilities
that have dangerous capabilities, mostly
those that allow remote code execution(RCE) or privilege escalation (PE). These
are highly valuable to attackers andsignificantly increase an organization’srisk of becoming a victim• Trending Vulnerabilities: These arevulnerabilities that are actively being
used in-the-wild. In this report, we further
refined the list by honing in on the CVEs
we found that were tied to ransomware
threats and families

Taking a Risk-Based View of Ransomware Vulnerabilities5

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

In the past report, the strategic vulnerabilities only
included those that had RCE or PE capabilities. In thisreport, as ransomware expands their targets, we’ve
included two additional dangerous capabilities. These
two vulnerabilities allow for distributed denial-of-service(DDoS) execution and permission changes on VPN/

111,746

Total NVD Vulnerabilities

9,895

Weaponized

remote access gateways (CVE-2017-0177, Microsoft/
DDos and CVE-2019-11510, Pulse Secure/WebApp).
Here is a straightforward, yet powerful, model toprioritize vulnerabilities, especially those associatedwith ransomware.

2,161

223*

with Dangerous Tied to
Ransomware
Capabilities

124

Trending

Active Exploits

One interesting data note that we would like to highlight is that four
vulnerabilities presented as outliers to our dataset from last year’s
report. They were published between 2007-2008, but we found them
active in exploits during our research spanning 2010-2020.

CVE-2007-1036
CVE-2008-2992

CVE-2008-3431
CVE-2009-0824*These are now included in our totals for CVEs tied to ransomware.

Taking a Risk-Based View of Ransomware Vulnerabilities6

2021 Spotlight Report

Weaponized, Dangerous,& Trending
Last year’s Ransomware report focusedon 2010-2019 looking at CVEs tied toransomware families. This year we reexamined this data with our extended teamand partnership with CSW and also added
focus on 2018-2020 trends. Changes due to
COVID-19 aided threat actors, allowing themto spread their wings and find vulnerabilities
that could be exploited moving up the‘application stack’ to remote technology
and software-as-a-service applications.
While 2020 saw unabated cyber attacks on
all industries, we wanted to understand theopportunities attracting these threat actors.
It’s important to track the growth inransomware risk by looking at the new
CVEs each year, verifying if they havedangerous capabilities and mapping themto our research to understand if they aretied to ransomware families. This shows
the growth in exposure points and gateways
for ransomware to attack organizations.
However, equally important is tracking thetotal number of CVEs that are trending andactively used in exploits. This number is nottime bound and shows how ransomware
families are leveraging a greater amountof older vulnerabilities in their arsenal year
after year.

Ransomware – Through the Lens of Threat and Vulnerability Management

Growth in Weaponization
For the vulnerabilities that were published during 2018-2020 andcomparing it to the previous two years, we saw an improvement in
the percentage of vulnerabilities that became weaponized. Yet, 5%
becoming weaponized is still a concern for organizations.

Growth in Dangerous Vulnerabilities(RCE/PE Capabilities)
Dangerous vulnerabilities have two characteristics, they have
weaponized exploits and they have the capability of Remote Code
Execution (RCE) or Privilege Escalation (PE) that significantly
increases risk to an organization. While the amount of vulnerabilities
that became weaponized decreased, the count of RCE/PE
vulnerabilities increased. Over 25% of newly published CVEs, pose agreatly elevated risk factor due to RCE/PE capabilities.

Taking a Risk-Based View of Ransomware Vulnerabilities7

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Growth in Vulnerabilities
Tied to Ransomware
While the other areas we researched lookedat vulnerability capabilities, this section takes
a different view, looking at our ransomware
findings and the growing risk to organizations.
Vulnerabilities tied to ransomware continue
to grow in number. Our findings show thatthey will continue as along as the assets theytarget continue to persist. It’s safe to say thatonce a vulnerability is tied to ransomware
it should be considered an elevated risk toorganizations, no matter what time frame it
was first identified.
Looking at just vulnerabilities tied toransomware, we saw growth of nearly 40%,in how families leverage the full spectrum ofvulnerabilities available to them during 20182020 for their nefarious activities.

Growth in Trending/Active
Exploits among Vulnerabilities
Tied to Ransomware
Weaponized vulnerabilities and their dangerous exploit capabilities(RCE/PE) provide the macro-level context to evaluate increased risk
to an organization. Comparing these same time periods, we see
moderate growth in risk, 21% to 25.57%. However, when honing inon ransomware risk and the vulnerabilities tied to ransomware, thecontribution of these two time periods shows a larger growth in risk
exposure for organizations. 2018-2020 contributed to nearly 40% of
the vulnerabilities we identified in this data set. More concerning isthat 66.29% of this data set are currency seen as trending with active
exploits within our findings on ransomware families.
This risk index highlights the growing ransomware exposure thatcannot be addressed unless continuous ransomware threat-context
can be applied to an organizations vulnerability management andprioritization program.

Taking a Risk-Based View of Ransomware Vulnerabilities8

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

3

Analyzing Ransomware
Vulnerabilities & Risk Factors
To categorize the adversarial risk of a vulnerability both CSW’s database of CVE data, traits, andattack characteristics, SecurIn Vulnerability Intelligence Quotient (VIQ) and

RiskSense’s Vulnerability Risk Rating (VRR) are used. Together these analytics guided
by security experts help define the most active threats. Collaborating and using threat intelligence, exploit
validation, and field experience, dangerous vulnerabilities that are being actively used are discovered. Thisoutcome provides the Trending category of vulnerabilities we reveal in this paper that elevates the risk
this group poses to an organization.

Analyzing Ransomware Vulnerabilities and Risk Factors

92021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Analysis of CVSS Scores& Severity Rating System
Relying only on CVSS severity scoring to prioritize
vulnerabilities can be a bad idea. While CVSS is useful,its downfall is that it only looks at the individual
vulnerability and has limited context on how adversaries
can leverage them to infiltrate organizations or how
active they are utilizing them in their threat campaigns.
Looking at the common CVSS v2 scoring across all of
the 223 vulnerabilities tied to ransomware, we found 158
vulnerabilities with a CVSS v2 severity rating of High.

Vulnerabilities Tied to Ransomware
with CVSS v2 Scoring (2010-2020)

However, what’s important is that from 2018-2020, using
CVSS v3 scoring, if you were to patch only the Criticalvulnerabilities, your coverage against ransomware would
only be about 35% from the overall 111 vulnerabilities
that have a CVSS v3 score. 91 CVEs tied to ransomware
families trended (2018-2020) and only 21 CVEs rated
Critical are a part of this list. If CVSS v3 Critical score is
the benchmark for prioritization, then you would be fixing
23% of the entire trending CVEs and still be vulnerable toransomware attack.
CVSS v2 and v3 scores can only be regarded as basic
benchmarks for rating vulnerabilities, but when it comesto ransomware, they are not a good indicator for thistype of threat risk. This shows that organizations needsomething more sophisticated that takes into accountreal-world threat context to help them prioritize theirpatching to minimize ransomware risk exposure.

Vulnerabilities Tied to Ransomware
with CVSS v3 Scoring (2018-2020)

The relationship between trending and CVSS v2 scoring
does not provide any direct correlation when it comes tovulnerabilities tied to ransomware. If standard practice
was to prioritize remediation based on CVSS v2 Highscoring CVEs during 2010-2020, only 158 out of 223 would
be accounted for, leaving an exposure gap of just over 29%
from unpatched vulnerabilities tied to ransomware.

Analyzing Ransomware Vulnerabilities and Risk Factors

102021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Vulnerabilities Tied to Ransomware
with Severity Scoring CVSS v2 (2018-2020)
You can see the increase in CVEs
tied to ransomware, all 223, and their
CVSS v2 scores, yet the majority of
those observed as being actively
used by in-the-wild attacks and thus
trending are clustered below the Highscoring tier.

One CVE does not have a
CVSS Score from the US
NVD Listing, and interestingly,
we know that it is usedby ransomware families:

CVE-2019-8720

Low Scoring Vulnerabilities
Because low scoring vulnerabilities are deceptive and fly under the radar of patching priorities, we wanted to research what
this means for ransomware exposure. We found 7 CVEs ranked as low looking at their CVSS v2 scores tied to ransomware.
We also observed that 2 CVEs that, despite their Low scores, are in high demand among multiple ransomware families.
CVE-2016-3298, with a CVSS v2 score of 3.2 and CVSS v3 score of 5.3, are tied to 36 ransomware families. CVE-2017-0213,
with a CVSS v2 score of 1.9 and CVSS v3 score of 4.7, continues to be popular and is currently trending across 5 active
ransomware families. Other vulnerabilities with CVSS v2 score of less than 8 are also a concern:• There are 128 CVEs that belong in this category in our
research from 2010-2020.
• 41% (53 out of 128) of these vulnerabilities had been
observed and tied to active ransomware threats
during the past decade.
• 35% (45 out of 128) are seen currently trending from2018-2020.

Even though CVSS v3 altered their scoring methodology
to look at impact we still find ransomware risk exposure
even with this elevated scoring method:• The number of vulnerabilities tied to ransomware,with CVSS v3 scores less than 8, is 49 in our researchfrom 2010-2020.
• 32% (16 out of 49) of these vulnerabilities had been
observed and tied to active threats during the past
decade.
• 30% (15 out of 49) are trending during our current
research period of 2018-2020.

Analyzing Ransomware Vulnerabilities and Risk Factors

112021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Top 10 Low Scoring Vulnerabilities Tied to Ransomware (2018-2020)
CVE ID

Product Name

CVSS v2 Score

CVSS v3 Score

CVE-2017-0213

Microsoft

1.9

4.7

CVE-2016-3298

Microsoft

2.6

5.3

4.3

N/A

CVE-2013-2423

OracleCanonical

Fermilab

GentooRed HatIBM

Mandriva

AmazonCentosNovell

CVE-2013-2618

Network-Weathermap

4.3

N/A

CVE-2013-3896

Microsoft

4.3

N/A

CVE-2013-7331

Microsoft

4.3

N/A

CVE-2017-0147

Microsoft

4.3

5.9

CVE-2009-0824

Slysoft

4.9

N/A

CVE-2010-0738

RedHatHP

Juniper

5

N/A

OracleNovellFermilab

AmazonRed HatIBM

Mandriva

Gentoo5

N/A

CVE-2013-0431

CentosOur data shows that ransomware risk cannot be
managed by utilizing CVSS scoring. It also points
to a systemic vulnerability management problem
with ransomware families continuing to rely on thevulnerabilities that traditionally don’t get priority
when it comes to remediation.

Older Vulnerabilities
Most of the ransomware we saw found a gateway
into the target network through the use of older
vulnerabilities. For the purpose of this report, we havetagged any vulnerability that was discovered in 2019 orin previous years as old vulnerabilities.
The oldest trending vulnerability that we analyzed inthis report was CVE-2007-1036, an RCE vulnerability
associated with the Crypsam (SamSam) ransomware

family. Two vulnerabilities from the year 2008 are also
very active with ransomware, CVE-2008-2992 and CVE2008-3431, with observations of them trending in 2017and 2020, respectively.
213 CVEs (96%) out of 223 are older vulnerabilities.
We also found that 120 of these vulnerabilities wereactively used in ransomware threats that trended in thepast decade, and 87 are currently trending (2018-2020).
For those who have focused on their organizational
exposure remediating only current vulnerabilities,
continuing to put off older vulnerabilities, this should bea wake-up call.
Organizations that want to hone in on the vulnerabilities
from 2017, 2018, and 2019 would do better with regards
to ransomware exposure, as these years were the largest
contributors, respectively adding 11, 8, and 10 CVEs tied
to ransomware.

Analyzing Ransomware Vulnerabilities and Risk Factors

122021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Vulnerabilities Tied to Ransomware and Trending by Year of NVD Publication (2018-2020)

Top 10 Older Vulnerabilities Most Active with Ransomware Families (2018-2020)
CVE ID

Ransomware Family

Ransomware Name

CVE-2008-3431

Robinhood

Robinhood

CVE-2009-0824

Robinhood

Robinhood

CVE-2010-0738

Satan

CVE-2010-0840

RevetonCVE-2012-0158

Locky

GimemoCerberBuran

CrowtiCry

CrypwallCVE-2012-0507

Crypsam (Sam Sam)

SamSa

5ss5c

Lucky

SamSa

DBGer

satan

SamSamReveton
Locky

GimemoGoopicCerber

BartCrypt

GetCrypt

MatrixCrowti

Buran

GoopicCrypMIC

Mobef

Crytowall

Cry

MatrixKovterCryptoMix

NanoLocker

Kovter

CrypMIC

Mobef

Locky

Crypfort

Nemty

Locky

CryptoMix

NanoLocker

Reveton

CryptoShield

Paradise

Reveton

CryptoFortress

Nemty

Sodinokibi

CTB-Locker

Philadelphia

Sodinokibi

CryptoShield

Paradise

Cryptesla

Dxh26wam

Princess Locker

Teslacrypt

CTB-Locker

Philadelphia

Cryptohasyou

ErebusCrypradam

AlphaCrypt

Dxh26wam

Princess Locker

Alma Locker

ERIS

Sage

Cryptohasyou

ErebusRadamant

AnteFrigus

Globe

Spora

Alma Locker

ERIS

Sage

ASN1

FessLeakCrypshed

AnteFrigus

Globe

Spora Shade

BandarChor

GandCrab

Cryptoluck

ASN1

FessLeakTroldesh

BartCrypt

GetCrypt

BandarChor

GandCrab

YafunnLocker

Analyzing Ransomware Vulnerabilities and Risk Factors

132021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Top 10 Older Vulnerabilities Most Active with Ransomware Families (2018-2020), continued
CVE IDCVE-2012-1723

CVE-2012-4681

CVE-2013-0074

CVE-2013-0422

Ransomware Family

Ransomware Name
Cerber

CTB-Locker

Paradise

UrausyDxh26wam

Philadelphia

Cryptohasyou

ErebusPrincess Locker

Alma Locker

ERIS

Radamant

AnteFrigus

Globe

RevetonASN1FessLeak

Sage

BandarChor

Flimrans

Sodinokibi

BartCrypt

GandCrab

Spora

Buran

GetCryptTeslaCryptCry

GoopicAlphacrypt

CrypMIC

Locky

Shade

CryptoMix

Matrix

Troldesh

CryptoFortress

Mobef

YafunnLocker

CryptoShield

NanoLocker

Cryptowall

Nemty

UrausyLyposit

RevetonUrausyCrypwall

NanoLocker

Sodinokibi

CryptoShield

Mobef

Waltrix

Nemty

Cryptohasyou

Cryptowall

NanoLocker

Alma Locker

CTB-Locker

Paradise

Alma Locker

Waltrix

Nemty

Cryptesla

Dxh26wam

Philadelphia

TeslaCrypt

CTB-Locker

Paradise

AnteFrigus

ErebusPizzaCrypts

Alphacrypt

Dxh26wam

Philadelphia

ASN1

ERIS

Princess Locker

AnteFrigus

ErebusPizzaCrypts

BandarChor

Globe

Crypradam

ASN1

ERIS

Princess Locker

BartCrypt

FessLeak

RevetonBandarChor

Globe

Radamant

Better_call_saul

GandCrab

Sage

BartCrypt

FessLeak

Reveton

Buran

GetCrypt

Spora

Better_call_saul

GandCrab

Sage

CerberGoopicTorrentLocker

Buran

GetCrypt

Spora

Cry

CrypHydra

Crypshed

CerberGoopicTorrentLocker

CrypBoss

JuicyLemon

UmbreCrypt

Cry

CrypHydra

Shade

CrypMIC

KovterCryptoluck

CrypBoss

JuicyLemon

Troldesh

CryptoMix

Locky

Zepto

CrypMIC

KovterUmbreCrypt

Crypfort

Matrix

CryptoMix

Locky

YafunnLocker

CryptoShield

Mobef

CryptoFortress

Matrix

Zepto

CerberCrypwall

NanoLocker

UrausyCTB-Locker

Nemty

Cryptohasyou

Dxh26wam

Paradise

Alma Locker

ErebusPhiladelphia

AnteFrigus

ERIS

Princess Locker

ASN1

Globe

Crypradam

BandarChor

FessLeak

Reveton

BartCrypt

Flimrans

Sage

Buran

GandCrab

Sodinokibi

Cry

GetCrypt

Spora

CrypMIC

GoopicCryptesla

CryptoMix

Locky

Crypshed

Crypfort

Matrix

Cryptoluck

CryptoShield

Mobef

Lyposit

RevetonSodinokibi
Cryptohasyou

RevetonRevetonAnalyzing Ransomware Vulnerabilities and Risk Factors

142021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

CWE Weaknesses Most Aligned
for Ransomware Exploit

We found popular bug bounty programs offeringresearchers and bounty hunters huge payments
to find vulnerabilities in these categories:

When we identified the large number of vulnerabilities tied
to ransomware, we decided to investigate which Common
Weakness Enumerations (CWEs) are being most abused.
We identified the top 5 CWEs by the highest count ofassociated CVEs (CWE-119, CWE-20, CWE-264, CWE-94,
and CWE-200).

CWE-16

CWE-89CWE-863

CWE-352

CWE-434

CWE-918

CWE-79CWE-311

CWE-120CWE-200

CWE-78This reinforces the fact that vulnerabilities withinthese weaknesses are sought out by threat actors
systematically to weaponize.

Of these, CWE-119, CWE-20, and CWE-94 are found in2020 Top 25 Most Dangerous Software Weaknesses.

Vulnerabilities Tied to Ransomware and Trending by Year of NVD Publication (2018-2020)CWE

CWE Name

Number of instances

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer36

CWE-20

Improper Input Validation

25

CWE-264

Permissions, Privileges, and Access Controls

15

CWE-94

Improper Control of Generation of Code ('Code Injection')

11

CWE-200

Information Exposure

9

CWE-416

Use After Free8

CWE-787

Out-of-bounds Write

8

CWE-189

Numeric Errors

6

CWE-502

Deserialization of Untrusted Data

6

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

6

Analyzing Ransomware Vulnerabilities and Risk Factors

15

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

4

Ransomware Families,
APT Groups, & Exploit Kits
This year, we increased our research to growour understanding about ransomware families.
We identified 125 ransomware families who
are delivering ransomware attacks utilizing 223
unique CVEs. The average number of CVEs per
ransomware family is 17 CVEs in this year’s
report, while in our 2019 report the average was
4 CVEs per family.
Interestingly, we also observed that 42
ransomware families only use old vulnerabilities(2019 and earlier NVD publication dates) totarget their victims, the oldest being from 2010.

A few prominent families (with their CVE count):• Crypwall (66)
• Locky (64)
• Cerber (62)• Cryptesla (56)
• Reveton (46)
• Waltrix (45)
• Sodinokibi (41)
• Kovter (40)• Cry (37)
• Philadelphia (37)

Ransomware Families, APT Groups, and Exploit Kits

16

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Ransomware Family Details

2017-0213, CVE-2019-0803, CVE-2017-0145, CVE2017-0144, and CVE-2017-0147) from this family
trended from 2018-2020. Though the family is slow to
update their arsenal with new vulnerabilities, they arestill active and an interesting ransomware family tocontend with.

Ransomware Packages per Family
Let’s take a closer look at the top three largest
ransomware families based on the count of ransomware
packages associated with each.
• WannaCry: The WannaCry ransomware family has
7 ransomware packages within its fold and targets
their victims through 14 CVEs - all discovered in 2017.
The WannaCry ransomware attack was a global
cyberattack that took down businesses worldwide
and was the first global ransomware attack thatencrypted hundreds of thousands of computers inmore than 150 countries within a matter of hours.
It used the vulnerabilities inherent in Windows SMB
protocol using NSA’s classified hacking tools andthe EternalBlue exploit to deliver the ransomware.
Seven CVEs (CVE-2017-0146, CVE-2017-0143, CVE-

Top 10Ransomware
Families by
Number of
CVEs(2018-2020)• GandCrab: Ransomware families like GrandCrab
have 6 ransomware packages using 51 CVEs within
its fold. The vulnerabilities adopted by this family aremostly older CVEs but ages range from 2012 to 2019,
we have not seen any additions in 2020.
• CryptoMix: Discovered in 2016, this ransomware
family has 5 ransomware packages within its fold
and 51 CVEs including CVE-2019-19781 that hit
thousands of companies. This ransomware family
has survived for more than four years and continues
to add recent vulnerabilities into its arsenal, showing
its adaptability and threat potential.

Crypwall

66

Locky

64

Cerber62

Cryptesla

56

GandCrab

51

CryptoMix 50
Reveton46

Waltrix

45

Sodinokibi 41
Kovter40

Cryptowall
Cryptowall 2.0
Cryptowall 3.0
Cryptowall 4.0
EDA2
Locky
CerberMagniberTeslaCrypt
Alphacrypt
GandCrab
GandCrab 4
GandCrab 5
GandCrab 5.0.1
GandCrab 5.0.9
CLOP
Mole
CryptFIle2
CryptoMix
CryptoMix Revenge
IcepolReveton
CryptXXX
REvil/Sodinokibi
Sodin
Sodinokibi
KovterRansomware Families, APT Groups, and Exploit Kits

17

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Ransomware Families and Growth in
the Number of CVEs They Utilize

Another observation is that 11 ransomware families
seem to be actively adding newly discovered
vulnerabilities to their fold. CryptoMix, a family withfive ransomware strains is the leader in this category
adopting 51 CVEs of which 19 vulnerabilities were foundtrending in 2018-2020.

We observed the Crypwall ransomware family surge
to the top of the list as one of the biggest ransomware
families, with 4 ransomware strains tied to it and 66 CVEs
within its fold. Locky is the second contender, with two
ransomware packages and 64 vulnerabilities. Cerber has
two ransomware strains and 62 CVEs tied to it. The 2019
report leader using the highest count of CVEs within theirransomware was Cerber with 17 CVEs. Cerber increased
the number of CVEs they utilize by 27%.

Vulnerability Usage AcrossMultiple Families
In last year’s report, we saw 12 ransomware families
sharing 15 vulnerabilities to target their victims. This
year, we observed this number greatly increase to 107
CVEs being leveraged by 113 ransomware families.

CVEs Shared Among Multiple Ransomware Families
CVE ID

Families

Vulnerable Element

CVSS v2

CVSS v3

VRR

9.3

N/A

10

CVE-2010-0188

UrausyCryptohasyou
CerberCryptoMix
Crypfort
CrypwallCVE-2010-0738

satan
Crypsam (SamSam)
SamSa

JBoss Enterpise Application Platform
Enterprise Linux
Junos space
Hp-ux

5

N/A

8.53

CVE-2010-1428

Crypsam (SamSam)
SamSa

JBoss Enterpise Application Platform
Enterprise Linux
Junos space

5

N/A

6.16

CVE-2012-0158

Locky
GimemoOfficeSQL Server
Commerce server
Visual Basic

9.3

N/A

9.68

CTB-Locker
Locky
NanoLocker
Cryptesla
Crypshed

Acrobat Reader
AcrobatRhel_extras
Enterprise LinuxLinuxSUSE Linux
Opensuse

Office web components
Biztalk server
Visual foxpro

Ransomware Families, APT Groups, and Exploit Kits

18

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

CVEs Shared Among Multiple Ransomware Families, continued
CVE ID

Families

Vulnerable Element

CVSS v2

CVSS v3

VRR

CerberCrowti
Crypwall
KovterLocky
RevetonSodinokibi
Cryptesla
Cryptohasyou
Alma Locker
AnteFrigus
ASN1
BandarChor
BartCrypt
Buran
Cry
CrypMIC
CryptoMix
Crypfort
CryptoShield
CTB-Locker

Dxh26wam
ErebusERISGlobe
FessLeak
GandCrab
GetCrypt
GoopicMatrix
Mobef
NanoLocker
Nemty
Paradise
Philadelphia
Princess Locker
Crypradam
Sage
Spora
Crypshed
Cryptoluck

JRE
Enterprise Linux
Rhel extras
CentosLinux
Ubuntu Linux
Debian
Debian GNU/Linux
Debian GNU/kfreebsd
SUSE LinuxJava 1.6
Vcenter server
Debian Linux

10

N/A

10

CVE-2012-1710

Locky

Petya

Fusion middleware

7.5

N/A

7.86

CVE-2012-1723

CerberUrausyCryptohasyou
Alma Locker
AnteFrigus
ASN1
BandarChor
BartCrypt
Buran
Cry
CrypMIC
CryptoMix
Crypfort
CryptoShield
Crypwall
CTB-Locker
Dxh26wam
ErebusERISGlobe
FessLeak

Flimrans
GandCrab
GetCrypt
GoopicLocky
Matrix
Mobef
NanoLocker
Nemty
Paradise
Philadelphia
Princess Locker
Crypradam
RevetonSage
Sodinokibi
Spora
Cryptesla
Crypshed
Cryptoluck

JRE
Jdk
Debian
Debian GNU/Linux
Debian GNU/kfreebsd
LinuxEnterprise Linux
CentosUbuntu Linux
Java_1.6
SUSE Linux
Scientific Linux
Debian Linux
Opensuse
Vcenter server
Vcenter update manager

10

N/A

10

CVE-2012-4681

Lyposit
RevetonUrausy

Jdk
Jre
Linux
Enterprise Linux
CentosFreebsd
SUSE Linux
Opensuse
Scientific Linux

10

N/A

10

RevetonUrausyJre
Jdk
Enterprise Linux
Linux
CentosUbuntu LinuxSUSE Linux
Esx
ESXi
Scientific Linux
Opensuse

10

N/A

10

CVE-2012-0507

CVE-2012-5076

Ransomware Families, APT Groups, and Exploit Kits

19

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

APT Groups
Advanced Persistent Threats (APT) and ransomware
association increases the power of this threat by several
notches. These threats are called ‘persistent’ for areason. The adversaries behind these threats are notsolely motivated by monetary gains. APT Groups are
seemingly well-funded, often by nation states who hirethem to conduct deep targeted attacks. Their focus
is on government, critical infrastructure, multinationalorganizations, and proprietary and sensitive information
within pharma, key manufacturing entities, and the
supply chain of their targets.

We are covering this trend because our research foundransomware also being used by APT groups. While theseadversaries are not going to infect their target’s networkand demand ransom through bitcoins, it does show how
ransomware can expedite a way into organizations.
We found 33 unique APT Groups using 65 ransomware as
their arsenal to disrupt, spy, and gather intelligence fromsensitive organizations. These APT Groups are largely
associated with nation states such as Russia, China, Iran,North Korea, Germany, South Korea, and Nigeria.

9

Russia1
1

United States

Germany1

Nigeria

1

8

Iran

China

1
1

North Korea
South Korea
10

APT Groups for Hire

Russian APT Groups such as APT28, Doppel Spider,Gold Southfield etc. are associated with notorious
ransomware strains such as Revil, Cerber, Sodinokibi,
Petya, Snake etc. Second in line are Chinese APT groups
such as Wizard Spider, Rocke, Naikon, APT40, andAPT41 that deploy Maze, Gimemo, Xbash, and Ryuk todisrupt critical industries.

Most APT groups go by many aliases or by the primaryransomware strain. For example, Sandworm APT Groupis also known as TeleBots, Sandworm, or BlackEnergy.
While we are sharing this high-level research, there are
deeper complexities of these groups that are evolving andnew capabilities starting to come to light. This report onlyshows the trends as we begin to map these relationships.

We also noticed that certain APT groups focus exclusively
on certain industries. For example groups like Wizard
Spider use ransomware like Ryuk rather efficiently
targeting hospitals and organizations associated withhealthcare and pharma.

Here is a list of APT groups, the ransomware strains theyuse, and their alleged nation state sponsors.

Ransomware Families, APT Groups, and Exploit Kits

20

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

APT Groups using Ransomware Strains Grouped by Nation Association (2018-2020)
APT Group

Ransomware Name

Nation State

AnonSec

Maze–

Anonymous

Maze

–

APT 1

Maze

China

APT10

Gimemo

China

APT28

Golang

APT29

Maze

–

APT 37

ErebusSouth Korea

APT40

GimemoChina

APT 41

Maze

China

Boss Spider

SamSamIranCycldek

GimemoChina

Doppel Spider

DoppelPaymer

RussiaDungeon Spider

Locky

RussiaEquation Group

NotPetya

FIN11

CLOP

FIN6

LockerGoga

Maze

Ryuk

–

GOLD SOUTHFIELD

REvil/Sodinokibi

Sodin

Sodinokibi

RussiaLazarus Group

HermesHermes 2.1

WannaCry

North Korea

NaikonGimemoChina

PARINACOTA

Dharma–Pinchy Spider

GandCrab
GandCrab 5
GandCrab 5.0.1

RATicate

Lokibot

–

Rocke

Xbash

China

Sandworm TeamBad Rabbit
NotPetya
PetrWrap

Shadow Brokers

Petya

SilverTerrier

Lokibot

SWEED

Lokibot

TA2101

Buran

Maze

TA505

Bitpaymer
CLOP
CryptFIle2
CryptoMix

CryptoLocker
DoppelPaymer
Globe Imposter

TA530

CryptoWall

–

Turla

Snake

RussiaWizard Spider

Ryuk

China

Zombie Spider

CerberPetya

RussiaUnited States

WannaCry–

GandCrab 5.0.9
REvil/Sodinokibi

Petya
Pnyetya

Sodin
Sodinokibi

WanaCrypt0r
WannaCry

RussiaRussia–Nigeria

Pony–

Shade (Troldesh)

Germany
Locky
Philadelphia
Pony

RussiaRussiaRansomware Families, APT Groups, and Exploit Kits

21

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Exploit Kits
We also saw ransomware families leverage common exploit kits. Exploit kits are automated tools used by hackers to
exploit a vulnerability and then deliver malware or ransomware payloads. Typical exploit kits today are loaded with exploits
that target common software such as Adobe, Flash, Java, Microsoft Silverlight, etc. Essentially, these are packaged
executables and a build of layered vulnerability attacks providing all the tools needed to target and mount an attack, orused to test the exploitability of an organization by penetration testing teams.
We found 29 exploit kits used across 84
ransomware strains. The top 5 most commonly
included exploit kits in this list are:Our research observed

Fallout and RIG• RIG Exploit Kit• Nuclear Exploit Kit

exploit kits available on a monthly
subscription basis in many of theransomware-as-a-service websites.

• Angler Exploit Kit• Neutrino Exploit Kit• Fallout Exploit Kit

RaaS• EternalBlue Exploit Kit

Ransomware Strains and Exploit Kits (2018-2020)
Ransomware Name

CryptoWall

Exploit Kit Count

8

Exploit Kits Used
Infinity

Neutrino

RIG

NuclearHiman

pseudo-Darkleech

FiestaMagnitude

Locky

7

Bizarro Sundown

TeslaCrypt

6

NuclearCerber5

GandCrab

4

SofosFO/Stamp

Reveton4

Cool

BandarChor

3

Empire Pack

Neutrino

RIG

Better_call_saul

3

Darkleech

pseudo-Darkleech

AnglerCryptFIle2

3

Nuclear

Neutrino

RIG

CryptXXX

3

Neutrino

pseudo-Darkleech

AnglerNuclearMagnitude

Neutrino

Sundown

RIG

Ransomware Families, APT Groups, and Exploit Kits

22

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

5 Ransomware as a Service
Until a few years ago, only groups withknowledge about security and with coding
expertise could launch and mount complex
cyber attacks. No longer is that a requirement
now that ransomware as a service (RaaS) has
become almost mainstream.
Ransomware as a service has enabled justabout anybody to launch ransomware attacks
without getting creative with code or havedeep security expertise. The relative ease ofthis process has attracted many malicious
actors. Of all the forms of cyber attacks thatexist today, the ransomware attack is the mostlucrative. This is a disturbing trend, monetizing

the tools that enable ransomware, along withthe escalating extortion tactics deployed byransomware families.
As we previously discussed, there is a crossoverwith many of these sites we found in our
research where exploit kits (Fallout and RIG
exploit kits) are options in many ransomwareas-a-service websites. It can be reasonably
assumed that the ease of subscription tothese exploit kits is enabling ransomware such
as Cryptowall, Locky, and TeslaCrypt to use
as many as eight, seven, and six exploit kits,
respectively, to mount their attacks.

Ransomware as a Service

232021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Fast Enablement with No Overhead
Ransomware as a service works pretty much in the same way as any other SaaS model selling services and productsubscriptions. You can pay and procure ransomware builders, malware strains, hire a way to hack popular social media
sites or build custom ransomware strains. We’ve found these types of services brazenly describe how their package canbe utilized and some even taut association with some of the biggest cyber crime attacks such as Petya or WannaCry as
examples to sell their wares.
One can create an account on these sites, check subscriptions for previously bought packages, and renew them easily. Each
purchase comes with detailed instructions on how to deploy the payload, making it extremely easy for anybody to launchan attack. These sites also have features such as FAQ, customer service, and quick help, making it easy for their nefarious
customers every step of the way.
A typical ransomware package
comes with many free add-ons andcustomization features, not to mention
fancy names and hashtags for products.
Customizations such as changing
ransom amounts based on how an
attack proceeds along with access to acomplete command center to monitor
the attacks are common. We’ve evenseen ransom payment pages and links
providing just about anything that an
attacker needs. As with anything thesedays, the customers of these services
are encouraged to leave a rating of how
well the service provided what they werelooking for.

Ransomware as a Service242021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

While not comprehensive, we were able to observe thefollowing ransomware available in a sampling of Dark Web sites
advertising ransomware as a service.

Ryuk
Bitpaymer
Gandcrab
Hermes
Revil
Dharmaegregor
NemptyProduct Categories with Expanding
Ransomware Risk
Trends that we’ve been tracking since we released lastyear’s report was that ransomware is moving towards
targets at the application layer, and towards products
heavily utilized due to COVID-19 such as VPN, accessgateways, and collaboration tools. One of the largest
new targets we observed is the one area that everyorganization relies on in case of a ransomware attack,their back-up solutions. Therefore, we cross-referenced
the products into broad categories to identify the trends
that are shaping up.

Application Vulnerabilities
Web & application development still is one of the moststrategic activities for most organizations. It is no
surprise that these web facing applications and mostpopular used frameworks are a target for ransomware.
RiskSense research previously identified Web andApplication Framework Vulnerabilities, this report looks
at which ones have been seen tied to ransomware.
• We found 18 unique CVEs tied to ransomware whencross-referencing this research

PrincessLocker
satan
Thanossodinokibi
Netwalker
Cerber
Nefilim
WannaCry

SaaS

SaaS Applications

We saw ransomware targeting 12 SaaS products with
47 vulnerabilities. We also found that 19 of these CVEs
are trending between 2018-2020. Top products with the
maximum number of vulnerabilities would be Apple’s
iCloud, Microsoft Outlook 365, HP’s Application Lifecycle
management, Oracle’s Fusion Middleware, Adobe’s
Adobe Air, IBM’s Lotus Domino, and Notes.
With the usage of SaaS products increasing, we predictthat threat actors will seek out vulnerabilities inherent inthese applications and weaponize them systematically.

Open Source Vulnerabilities
RiskSense research previously identified the risk fromOpen Source Vulnerabilities, this report looks at this list
and cross references with the 223 CVEs we found tied toransomware. 19 of these vulnerabilities exist within theOpen Source category and have been tied to ransomware.
These CVEs were found to exist among 7 Open Source
products such as Jenkins, MySQL, OpenStack, Tomcat,
Elasticsearch, OpenShift, and JBoss.

• The products targeted include: WordPress, Struts,
Java, PHP, Drupal, and ASP.net

Ransomware as a Service252021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Of concern here is that Open Source allows developers
to quickly deploy their products and it allows for quick
re-use and sharing within communities with libraries. This
also makes them a good target for ransomware utilization
allowing these threats to have broad reaching implications.

VPN

VPN/Gateway/Collaboration
Vulnerabilities

When COVID-19 pandemic induced a world-wide
lock down, Cyber Security Works released a seriesof ten reports, Cyber Risk in Working Remotely. This
research analyzed the vulnerabilities that exist in
popular applications and technologies used today forremote work and collaboration. We cross referenced
the CVEs listed in these reports against those foundtied to ransomware and found that many devices andapplications used by the world’s remote workforce
have vulnerabilities that open the door to ransomware
attacks. Notably, Pulse Secure, Sonicwall’s Secure
Mobile Access, Microsoft Host Integration Server, Mitel
Open Integration Gateway, Citrix Netscaler, Sophos XG
Firewall, and F5’s Big IP firewall have the maximum
number of CVEs linked to ransomware.
We also analyzed products such as online conference
tools, remote desktops, databases, and web proxies andfound them vulnerable to ransomware attacks.

• Microsoft’s popular online conference tool Microsoft Live Meeting has a vulnerability(CVE-2015-1671) that is linked to 14 ransomware families.
• 12 Firewall products are exposed with seven CVEs tied to ransomware:• Citirx: Netscaler Access Gateway Firmware• Citrix: Application Delivery Controller Firmware• Citrix: Application Delivery Controller• Citrix: Netscaler Gateway Firmware• Citrix: Netscaler Gateway• Citrix: Gateway Firmware• Citrix: Gateway• F5: Big IP Advanced Firewall Manager• F5: BIg IP Advanced Web Application Firewall• Mitel: Mivoice Border Gateway• SonicWall: Web Application Firewall• Sophos: XG Firewall• Three Gateway products (Microsoft Host Integration Server, Mitel Open Integration
Server, and SonicWall Secure mobile access) and one VPN, notably Pulse Secure
Connect, have vulnerabilities that provide a gateway to ransomware.

Ransomware as a Service

262021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Backup & Storage Vulnerabilities
We found 12 backup storage devices with 22
vulnerabilities tied to ransomware. These include popular
products such as Apple’s iCloud, Citrix’s Xenserver,
Microsoft’s Sharepoint, Netapp’s Cloud Backup, andRedHat’s JBoss Data Grid. Five vulnerabilities (CVE2015-1641, CVE-2017-0199, CVE-2018-15982, CVE-2018-

4878, and CVE-2015-5122) that are present in theseproducts were actively exploited between 2018-2020.
When we looked at the CWE information, we found thefollowing weakness categories appearing multiple times:
CWE-79, CWE-416, and CWE-119. Vulnerabilities thatbelong to these CWEs exist in these popular backup
storage devices. We also looked at the CVEs that wereactively exploited in 2018-2020 and found that they
belong to these CWEs, CWE-39 and CWE-416.

Product Categories & CVE Count
Product Type

Product
Count

CVE
Count

Trending(2018 - 2020)

Top Product Names
iCloudBackup Storage

12

22

RedHat Enterprise Linux Server

5

NetApp Storage Automation Store
Online Conference22

Database

3

4

Microsoft Live Meeting2

Selligent
Apache ignite
Elasticsearch2

Microsoft SQL Server
Gateway3

2

Microsoft Host Integration Server

0

VPN

1

1

Pulse Secure - Pulse Connect Secure

1

Citrix Netscaler
Firewall12

7

Citrix Gateway firmware

3

F5 BIg IP - Advanced web app firewall
SonicWall web application firewall
Sophos XG Firewall

SaaS Products

1247Open Source

817Adobe-Air

ibm - Lotus-domino

iCloudnotes

Outlook 365

oracle fusion middleware

JBoss

Openstack

MySQL

Elasticsearch
8

Jenkins
Web Application

6

18

19

WordPress

DrupalStrutsJava

11

Ransomware as a Service272021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

Ransomware Vulnerabilities
Impacting Multiple Products

A good example of this problem is Intel’s AtomC
processor that has a Speculative Store Bypass
vulnerability (CVE-2018-3639) that is now present in 25
products & vendors (Microsoft, Canonical, Novell, Debian
Gentoo, and many others).

This is a trend we called out in the previous year’s report.
We noticed 19 CVEs, 17 of them trending vulnerabilities,
found across multiple vendors and products. We showed
how software components are often reused acrossmultiple products and even vendors, making it hard to
track these exposure points.

Two vulnerabilities present in Linux language
vulnerabilities CVE-2018-5391 (present in Linux kernel,
versions 3.9+) and CVE-2014-3153 (Linux Kernel version
3.14) have been found affecting products such as
Canonical, Novell, Huawei, Debian, RedHat, Centos, Oracle,
Amazon, Fermilab, VMware, Virtuozzo, Arista, Juniper, F5,
Slackware, Cisco, CPE, Palo Alto Network, Linux, Fedora
Project, SUSE, Mandriva, etc.

This year we found 102 CVEs tied to ransomware spread
across multiple vendors and products, exacerbating thispatching problem. This trend is part of the changing
dynamics of today’s attack surface that threat actors love
to take advantage of.

CVEs Tied to Ransomware Seen Across Multiple Products

5xincrease

2019

19

2020

102

0

20

40

60

80

100

120

Ransomware as a Service282021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

6 SummaryRansomware threats are no more a pesky headache as they continue to mature. The growing risk is how
many ransomware attacks do not need deep technical knowledge or expertise - thanks to the emergenceof ransomware as a service.
While we looked at various angles of ransomware
through the lens of threat and vulnerability
management the growth in vulnerabilities tied toransomware we believe will continue. The otherconcerning aspect is the growth of ransomware
families, the expanding strains of ransomware
they are creating, and the increase in use of
weaponized vulnerabilities among them.
The way to defend against this threat iselevating cyber hygiene and continuous riskbased vulnerability management that provides
active threat-context about ransomware.
Today this research is the only source fororganizations to quickly understand their attack
surface exposure and what is contributing to
the growth in ransomware attacks organizations
are experiencing.

“

While server and operating systems were
the original targets, ransomware threats
are moving up the stack to applications SaaS, Web and Application frameworks,
and of course Open Source.”– Srinivas Mukkamala
Founder & CEO of RiskSense

Risk-based vulnerability management continues
to evolve and we’ve shown that traditional waysof assessing CVE risk, using CVSS scoring andvulnerability age, when it comes to ransomware
is not helpful.

“

Attack Surface Management (ASM) isall about organizations reducing their
exposure to ransomware. The numberof vulnerabilities associated withransomware have quadrupled in 2020
which means organizations need toview vulnerabilities from a ransomware
context and patch them continuously.”– Ram Swaroop
President & Co-founder,
Cyber Security Works

The landscape and tactics used by ransomware
families and adversaries behind them are quickly
changing and we provide this research as a way
to educate and help organizations understandthis evolving threat.

Summary29

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

7 Report Methodology
The information in this report is based on data gathered from a variety of sources including RiskSense& CSW’s proprietary data, publicly available threat databases, as well as RiskSense & CSW threat
researchers and penetration testing teams.
We hope this research can serve as a starting point for organizations wishing to take a risk-based
approach to ransomware exposure to prioritize patching to secure their enterprise and reduce their attack
surface. Simply put, most organizations are inundated with more vulnerabilities than they can patch, so we
wanted to provide the various perspectives and details we uncovered about ransomware to shed light on
the trends and key findings to help manage their vulnerability risk backed by research.

• Our Focus: We focused on vulnerabilities
that came into existence between 2010 to2020 and tracked their trending dates andtheir associations with ransomware andfamilies, unless there is a specific callout
to older vulnerabilities. We extensively
analyzed the vulnerabilities that trended in
the past two years (2018-2020) and also
identified those CVEs and trends that are ofinterest that we observed during the 2020
calendar year
• Definitions: All through the report, you will
notice that we use the words ‘trending’and ‘actively exploited’. They are distinctly
different in what we wish to convey withregards to this report• Actively Exploited: Any CVE that has beenused to launch ransomware attacks inthe past is defined as being tied to active
ransomware exploits during the specified
time period• Trending: Any CVE that is seen within active
ransomware exploit in the most recent time
period, mostly from (2018-2020), or when
we are specifically calling out 2020 activities

Report Methodology

302021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management

RiskSense Vulnerability Risk Rating

RiskSense VRR analysis to cross-reference the data that
we gathered.

Vulnerability Risk Rating (VRR) is designed to decipher
cybersecurity risk from the widest angle possible, using
an algorithm that intelligently separates and elevates
the riskiest weaknesses. It takes in the highest fidelity
vulnerability and threat data and leverages our deep
expertise providing human validation of exploits andexploit impact.

Our goal in building Vulnerability Intelligence Quotient(VIQ) is to be a single point of reference where
ransomware is concerned and provide companies,
ransomware survivors, high-value entities, and vulnerable
organizations with reliable data that would help protect
them from ransomware attacks.

Vulnerability exposure is more than just assessing IT
and cloud infrastructure; it also includes the applications
and web services critical to digital business. Acrossinfrastructure and applications, diverse types ofdata are now at play from the multitude of scanners,
tools, and sources that deliver vulnerability findings
and weaknesses. A fundamental step in being able
to express adversarial risk is to normalize this data,bringing together the impact a vulnerability poses,
enriched with threat context and trending exploits tounderstand the likelihood of it being exploited. Doingso allows each vulnerability to be quantified with a risk
rating and be prioritized accounting for its exposure
potential. The outcome of VRR is that it provides acurrent view of adversarial risk against a CVE or CWE.
RiskSense Risk-Based Vulnerability Management
platform includes the continuous VRR assessment of
all CVE findings. Included with this product is our uniqueRansomware risk dashboard, automatically delivering
the correlation of ransomware vulnerability exposure,prioritizing which findings need immediate action andthe tools to enable the fastest path toward remediation.
For more information, contact info@risksense.com.

CSW’s SecurIn Vulnerability
Intelligence Quotient
CSW’s team of threat hunters started this exercise with agoal of creating a database that would contain updated
and accurate information about ransomwares and thevulnerabilities that are used as a gateway. We collated
this information from a few trusted sources and used

This year, our team took into account all the CVEs thathave been added to NVD from 2010 to 2020 and labeled
them using an algorithm-based approach. Next, ourteam of threat hunters examined these weaponized
CVEs and mapped their connection to ransomware,ransomware families, APT Groups, and Exploit Kits. Next,
we examined how many of these vulnerabilities trended
in the past two years and were abused extensively in2020 and came up with an exhaustive list of CVEs.
96% of the vulnerabilities that we examined for this reportare old vulnerabilities, and CVSS v3 scores for 112 CVEs
are not available. Therefore, for most parts of the report,
we have used CVSS v2 scores to assess the severity ofthe vulnerabilities, and wherever the ratings are available,
we have added context from CVSS v3 scores.
The sheer size of the CVEs tied to ransomware
families and the unabated attacks on highly vulnerable
organizations tells us that ransomware research can’t be
an annual affair anymore. This needs to be undertaken
on a month-on-month or at least on a quarterly basis.
With the help of CSW’s extensive ransomware database,we will release many supplemental reports that would
shed more light on the ransomware attack vectors andthe vulnerabilities they choose as a gateway.
SecurIn’s VIQ is one among the many products that CSW
will be launching in 2021. VIQ is a dynamic database ofvulnerabilities mapped to threats, exploits, ransomware,
exploit kits, APT groups, etc. that would be soon available
on a subscription basis. If you are interested in thisproduct, contact data@cybersecurityworks.com for
more information.

Report Methodology

31

Spotlight_Ransomware_20210204

RiskSense®, Inc. provides risk-based vulnerability
management and prioritization to measure and control
cybersecurity risk. The cloud-based RiskSense platform
uses a foundation of risk-based scoring, analytics, andtechnology-accelerated penetration testing to identify
critical security weaknesses with corresponding
remediation action plans, dramatically improving
security and IT team efficiency and effectiveness. For
more information, visit www.risksense.com or follow us
on Twitter at @RiskSense+1 844.234.RISK | +1 505.217.9422
www.risksense.com

CSW is a cybersecurity services company focused on
attack surface management and penetration testing
as a service. Our innovation in vulnerability and exploit
research led us to discover 45+ zero days in popular
products such as Oracle, D-Link, WSO2, Thembay, Zoho,
etc., among others. We became a CVE Numbering
Authority to enable thousands of bug bounty huntersand play a critical role in the global effort of vulnerability
management. As an acknowledged leader in vulnerability
research and analysis, CSW is ahead of the game,helping organizations worldwide to secure their businessfrom ever-evolving threats. For more information, visit
www.cybsercurityworks.com or follow us on LinkedIn
and Twitter at @CswWorks

www.cybersecurityworks.com© 2021 RiskSense, Inc. and Cyber Security Works, Pvt. Ltd. All rights reserved. RiskSense and the RiskSense logo are registered trademarks of RiskSense, Inc. Cyber Security
Works, Cyber Security Works logos, and service names are trademarks of Cyber Security Works, Pvt. Ltd. All product names, trademarks, and registered trademarks areproperty of their respective owners.

2021 Spotlight Report

Ransomware – Through the Lens of Threat and Vulnerability Management