Security specialist company ESTsecurity (CEO Jung Jin-il) announced on the 13th that it blocked a total of 177,732 Ransomware attacks in the first quarter of 2022 through the 'Ransomware Behavior-based Pre-blocking' feature installed in its antivirus program 'ALYac'.

According to statistics, the number of Ransomware attacks blocked through ALYac in the first quarter was ▲a total of 177,732 cases, which can be seen as an average of ▲about 1,974 cases of Ransomware attacks being blocked daily when converted to a daily basis.

This statistic is the result of counting only the attacks blocked through the 'Ransomware Behavior-based Pre-blocking Function' of the public ALYac antivirus program provided for free to individual users, and it is estimated that the total number of attacks would be much higher when pattern-based attacks are included.

ESTsecurity selected the following as the main trends of Ransomware in the first quarter of 2022: ▲ the war between Russia and Ukraine and Ransomware ▲ the active VenusLocker group ▲ Magniber Ransomware spread through Typosquatting ▲ continued Ransomware damage to global companies.

First of all, the noteworthy issue in the first quarter of 2022 can be cited as Ransomware attacks related to Russia's invasion of Ukraine. The war between Russia and Ukraine has caused global confusion in various fields such as social and economic, and Ransomware attack organizations are also exploiting this issue. Among them, the typical Ransomware is HermeticRansom, which was found to play the role of bait for a wiper attack aimed at deleting data targeting Ukrainian systems, not for the purpose of extortion. In addition, a Ukrainian security researcher leaked the source code of Conti Ransomware, which is speculated to be a retaliatory act against the announcement that Conti Ransomware supports the Russian government.

The activities of the VenusLocker group also continue actively. The VenusLocker group, which has been consistently spreading Ransomware in South Korea since 2017, is still continuously spreading Ransomware in the country using contents such as resumes, copyright infringement, etc. Previously, the Makop Ransomware was continuously spread, but recently there have been signs that the LockBit Ransomware is being spread.

Typosquatting-based Magniber Ransomware distribution has also been rediscovered. Typosquatting is an attack method that redirects to another page if the domain address is entered incorrectly or spelled wrong. Magniber Ransomware is being spread targeting Chrome and Edge browser users using the Typosquatting method, and on the induced page, users are led to download an MSI file. MSI is an extension used in Windows Installer, and if the user runs the file without suspicion, they become infected with Ransomware.

Global companies are also continuing to suffer from Ransomware damage. The luxury clothing brand Moncler had data leaked after being attacked by the BlackCat (or AlphV) Ransomware in December 2021, and the leaked data was also released on the Tor network in January. Swissport International, an aviation services company, was also attacked by Ransomware, delaying some flights, and Nvidia was also confirmed to be affected by Ransomware attacks on some systems.

An ESRC official from ESTsecurity said, "The recent continuous increase in Ransomware attacks, as well as the distribution methods, are evolving to match the social environment," and "As the number of employees performing telecommuting to prevent the spread of the COVID-19 virus is increasing, it is mandatory to check the security update status of the OS/SW of the telecommuting terminals connecting to the company's internal network, as well as concurrently conducting employee security awareness training."

Meanwhile, ESTsecurity continues to collect Ransomware information and carry out organic response cooperation through close cooperation with the Korea Internet & Security Agency (KISA) to prevent domestic users from being harmed by Ransomware infections in advance.

In addition, ESRC has revealed other new or noteworthy Ransomwares discovered or worth attention in the first quarter of 2022.