Report: Ransomware Attacks Up 627%

According to the latest Internet Security Report from data security provider WatchGuard, ransomware at the endpoint level has surged 627% — despite an observed decrease at the network level of detected malware last quarter. What's the explanation?

Some 93% of malware is hiding behind encryption, WatchGuard said, and about 80% of the company's customers have not enabled https decryption in their firewalls, so the malware is going largely undetected until it reaches endpoints, where detections increased 22% overall.

"We continue to warn that most malware hides in the SSL/TLS encryption used by secured websites. Q4 continues that trend with a rise from 82% to 93%. If you don’t inspect this traffic, you are missing most malware — at least with your network security controls (endpoint security does still have a chance to catch it)."

The Internet Security Report is based on anonymized data collected from WatchGuard's Firebox appliances around the world. According to Watchguard: "Customer Fireboxes send a flurry of malware detections to our threat intelligence database, keeping us apprised of the latest trends. Network administrators who manage these Fireboxes have graciously allowed their devices to provide these anonymized detection reports to us. We analyze their details to understand what the malware landscape looked like last quarter and to investigate any trends or irregularities. With the data from this report, and previous ones, we can sometimes forecast what future malware trends might look like. We also make some conclusions and offer takeaways on defending against the current and future malware landscape."

The report also noted that overall network attacks were flat in the fourth quarter of 2022 compared with the previous quarter.

Among the other findings and recommendations:

  • Network-level detections of malware were down 9.2% for the quarter, despite endpoint detections being up. Recommendation: Inspect SSL/TLS traffic from secure websites before it reaches the endpoint.

  • Phishing attacks have increased. "Phishing and business email compromise (BEC) remains one of the top attack vectors, so make sure you have both the right preventative defenses and security awareness training programs to defend against it."

  • Lockbit continues to be a leading malware group for ransomware. "We continue to see Lockbit variants often, and they are definitely the group that seems to have the most success breaching companies (through their affiliates) with ransomware."

  • ProxyLogin exploits are growing. According to the report: "An exploit for this well-known, critical Exchange issue rose from eighth place in Q3 to fourth place last quarter. It should be long patched, but if not, you should know attackers are targeting it."

The complete report, including an executive summary and further details and analysis of findings from the quarter, is freely available on WatchGuard's site.

About the Author

David Nagel is the former editorial director of 1105 Media's Education Group and editor-in-chief of THE Journal, STEAM Universe, and Spaces4Learning. A 30-year publishing veteran, Nagel has led or contributed to dozens of technology, art, marketing, media, and business publications.

He can be reached at [email protected]. You can also connect with him on LinkedIn at https://www.linkedin.com/in/davidrnagel/ .


Featured

  • an online form with checkboxes, a shield icon for security, and a lock symbol for privacy, set against a clean, monochromatic background

    Educause HECVAT Vendor Assessment Tool Gets an Upgrade

    Educause has announced HECVAT 4, the latest update to its Higher Education Community Vendor Assessment Toolkit.

  • illustration of a football stadium with helmet on the left and laptop with ed tech icons on the right

    The 2025 NFL Draft and Ed Tech Selection: A Strategic Parallel

    In the fast-evolving landscape of collegiate football, the NFL, and higher education, one might not immediately draw connections between the 2025 NFL Draft and the selection of proper educational technology for a college campus. However, upon closer examination, both processes share striking similarities: a rigorous assessment of needs, long-term strategic impact, talent or tool evaluation, financial considerations, and adaptability to a dynamic future.

  • university building surrounded by icons for AI, checklists, and data governance

    Improving AI Governance for Stronger University Compliance and Innovation

    AI can generate valuable insights for higher education institutions and it can be used to enhance the teaching process itself. The caveat is that this can only be achieved when universities adopt a strategic and proactive set of data and process management policies for their use of AI.

  • DeepSeek on AWS

    AWS Offers DeepSeek-R1 as Fully Managed Serverless Model, Recommends Guardrails

    Amazon Web Services (AWS) has announced the availability of DeepSeek-R1 as a fully managed serverless AI model, enabling developers to build and deploy it without having to manage the underlying infrastructure.