The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. The perpetra…
Absolutely this - most ransomware attacks are pretty unsophisticated. You don't need privilege escalation, or an exploit. You can carry out the attack using just basic user permissions. You are exploiting a basic "problem" of most modern OSs (that apps run "as" the user executing them) - the user/group permission model ceases to work in 2021 with non-expert users. Portal-based access to individual files via secure OS…
As weird as it sounds, this is both correct and incorrect at the same time.
It is correct, because ransomware is not particularly sophisticated by today's standards. Couple of decades of R&D has made the building blocks robust and uninteresting.
It is also correct in the sense that the attacks used to breach systems are unsophisticated. A vulnerability is published for an internet-facing system, and in just couple of days the underground toolkits are already (ab)using it.
It is incorrect in the sense that the crews who breached the systems are not the crews who deploy ransomware. Computer crime has evolved to a fully functioning economy, with high specialisation among its participants. Crew A reverse-engineers patches, updates their vulnerability exploitation engines and goes on to breach systems. (In a race against time, because there are other crews doing the same.) They then sell access to crews B, C and D.
Crew B are after financial information and will exfiltrate anything that can be sold to morally ambivalent hedge funds. They may also grab R&D material, because corporate espionage is a thing. Crew C will grab all the personally identifiable data and have intimate knowledge how to best monetise it for various types of fraud.
Crew D will deploy the ransomware, because they have all the sophistication you need to run their extortion operations at scale. These days this includes the ability to handle massive volumes of off-site backups, because why not. "Pay up or we leak it" is a perfectly valid extension to their business model.
The gangs I referred to as "Crew A" are known in the industry as Access Brokers. There are of course other operators too who work in a more asynchronous fashion, such as money launderers.
The economy powering the criminal enterprise markets is certainly sophisticated. And while most of the technology in use doesn't qualify for using that word, the internal operations these gangs run certainly do.