Mitigating the Rising Tide of Malware and Ransomware Attacks

Ransomware and malware attacks are among the most widespread and dangerous types of cyberthreats organizations face today. As cybercriminals continue to evolve their methods, ransomware and malware attacks are becoming more advanced and damaging on a global scale.

In 2024, the rise of AI led to another sharp increase in these threats, with malicious software—including viruses, worms, and ransomware—causing serious problems across every industry, impacting the digital and real-world lives of both victims and defenders. Among these threats, ransomware remains a particularly devastating weapon. 

Ransomware attacks are notoriously disruptive, often involving the theft and encryption of a company’s data, rendering it inaccessible until a ransom is paid. The growing trend of encryptionless extortion, where attackers bypass encryption and rely on the threat of leaking stolen data, has put more pressure on victims to pay out of fear of sanctions and reputational damage.

The impact goes well beyond the financial burden of paying a ransom. Costs quickly escalate due to operational downtime, data recovery, legal issues, and loss of customer trust. Unfortunately, far too many organizations have already suffered these consequences. The stakes are now higher than ever. 

The Zscaler ThreatLabz 2024 Ransomware Report disclosed a 17.8% year-over-year rise in blocked ransomware activity in the Zscaler cloud, with attacks identified through data leak site analysis surging by 57.8%. ThreatLabz research also uncovered a record-breaking ransom payment of US$75 million earlier this year—the largest ransomware payment by a company in history.

Many factors are fueling ransomware’s reign, from generative AI advancements to the proliferation of subscription-based cybercrime services, also known as CaaS offerings, including ransomware-as-a-service (RaaS). Organizations must stay vigilant and informed in this ever-changing threat landscape and continuously adapt their defense strategies.

Understanding malware and ransomware threats

To effectively reduce risks associated with malware and ransomware, you need to understand the threats you’re up against. Equally important is an awareness of the common attack vectors that cybercriminals exploit to infiltrate systems. All this can help you develop stronger defense strategies as well as better anticipate and fend off potential threats.

Types of malware

Malware comes in many forms, each designed to exploit specific vulnerabilities or achieve particular objectives. Common types include:

• Viruses: Self-replicating programs that attach themselves to legitimate files and applications and spread to other systems.
• Worms: Standalone malware that self-replicates to spread to other computers, often exploiting vulnerabilities.
• Trojans: Malicious programs disguised as legitimate software, used to create backdoors for attackers to gain unauthorized access.
• Adware: Unwanted software designed to display advertisements, often leading to further infections.
• Ransomware: Malware that encrypts a victim’s data then demands payment for decryption, or threatens to leak stolen data if a ransom isn’t paid.

Ransomware variants: Most active families in 2024

Ransomware is constantly adapting as cybercriminals craft advanced and targeted variants. The ThreatLabz 2024 Ransomware Report reveals the most prevalent ransomware families currently wreaking havoc across various sectors, including:

• LockBit: Responsible for 22.1% of ransomware attacks, LockBit is highly aggressive and often hits small businesses with low ransom demands. Despite a law enforcement takedown in February 2024, LockBit resurfaced, launching a new wave of attacks.
• BlackCat: Also known as ALPHV, BlackCat accounted for 9.2% of attacks. Notable for its cross-platform compatibility, BlackCat used the Rust programming language for faster, hard-to-detect encryption. Although no longer active, the group’s affiliates have likely shifted to other ransomware-as-a-service networks like RansomHub.

The ThreatLabz report also identifies ransomware families expected to pose significant threats in 2024-2025, including:

• Dark Angels: Known for securing the largest ransom payment in history (US$75M), Dark Angels takes a highly targeted approach, typically focusing on just one company at a time, unlike most ransomware groups that attack indiscriminately and rely on affiliate networks of initial access brokers and penetration testing.
• Akira: As one of only major ransomware groups not directly disrupted by law enforcement to date, Akira is one of the most active ransomware families that commonly employs double-extortion tactics.

Common attack vectors

Understanding how malware and ransomware enter an organization’s systems is key to effective prevention. Key attack vectors include

• Phishing scams: Phishing involves deceiving users into revealing sensitive information or clicking on malicious links, often via email. ThreatLabz closely monitored phishing trends in 2023-2024, identifying several emerging techniques, including vishing (voice phishing), browser-in-the-browser attacks, and adversary-in-the-middle attacks.
• Software vulnerabilities: Unpatched software and outdated systems are easy entry points for cybercriminals to inject malware. Ransomware families have increasingly targeted known vulnerabilities over the past year, as detailed in the ThreatLabz 2024 Ransomware Report.
• Remote Desktop Protocol (RDP): RDP is commonly used for remote access and frequently targeted by attackers. Weak or compromised RDP credentials can grant direct access to an organization’s network, enabling attackers to deploy ransomware with relative ease.

Malware and ransomware prevention strategies

In response to these growing threats, organizations must adopt more proactive and resilient security strategies. Preventing malware and ransomware attacks requires a multifaceted approach that includes user education, regular system updates, and basic security best practices like multifactor authentication, endpoint protection, and a strategy rooted in zero trust architecture.

User education and training

Regularly educating employees is one of the most effective ways to reduce malware and ransomware attacks. Employees should understand how to recognize phishing emails, create strong passwords, and avoid suspicious websites and downloads.

Regular system updates

Keeping software and systems updated with patches to close security gaps makes it much more difficult for attackers to exploit vulnerabilities.

Multifactor authentication (MFA)

By requiring users to provide multiple forms of verification before gaining access to systems or data, MFA significantly reduces the likelihood that an attacker can breach an account.

Endpoint protection

Endpoints—and the users behind them—are often the most vulnerable parts of an organization, making them attractive targets for threat actors seeking to install malware, gain unauthorized access, or exfiltrate data. Real-time monitoring and comprehensive visibility of all endpoint activities are necessary to safeguard these vulnerable entry points.

Zero trust architecture

A zero trust architecture assumes every user, device, and connection is potentially compromised. By continuously verifying identities, inspecting all traffic (including encrypted data), and enforcing least-privileged access control, zero trust significantly reduces the risk of unauthorized access in the first place.
 

Detection and response planning

Even with robust prevention measures in place, it’s impossible to eliminate the risk of a malware or ransomware attack entirely. That’s why it’s essential to have strong solutions and plans to detect, protect, and respond to the latest variants and unknown threats.

Behavioral analysis and anomaly detection

Traditional signature-based detection methods are inadequate against rapidly evolving malware and ransomware threats. Organizations need advanced solutions that go beyond signature matching to monitor traffic and detect malicious activities and unknown payloads in real time.

Zscaler provides crucial capabilities like full TLS/SSL inspection, examining encrypted traffic to uncover hidden malicious activity. This deep visibility is vital to proactively identify malware and ransomware, enabling organizations to prevent successful cyberattacks.

Advanced inline sandboxing detects and blocks unknown payloads by using AI-powered analysis, machine learning, and integrated threat intelligence to quarantine suspicious files and executables in a controlled virtual environment. This approach not only identifies but also neutralizes malicious code before it can infiltrate a network, keeping organization ahead of emerging malware variants and zero-day attack.

Advanced deception tactics and decoys detect and disrupt lateral movement, effectively slowing down ransomware attacks. By strategically placing decoys around critical applications, Zscaler can mislead, monitor, and cut off attackers before they can cause harm. Interactions with these decoys trigger alerts to your SOC team, providing early warnings to speed up investigation and response.

Incident response plans

Establishing an incident response plan for malware and ransomware is necessary to ensure your organization can act decisively in the face of an attack and minimize both downtime and financial loss. A well-structured plan will help ensure your organization is prepared, and should include:

• Comprehensive scenario planning: Cover various scenarios, detailing recovering steps from initial attack validation through containment, investigation, eradication, and post-recovery analysis and reporting.
• Clear stakeholder roles: Make sure key stakeholders understand their roles and responsibilities in the recovery process to enable swift and coordinated action.
• Tabletop exercises: Conduct regular exercises that simulate real-world attack scenarios to help teams identify weaknesses, refine response strategies, and improve collaboration.
• Integration with business continuity planning: Include your ransomware response plan in your broader business continuity plan, and always keep a printed copy on hand in case digital access is compromised.
• Vendor partnerships: Work with vendors that can help you simplify and consolidate security products while providing strong product support to bridge any gaps in your team’s expertise.

Best practices to mitigate the impact of malware and ransomware attacks

Prevention and detection are crucial, but you should also be ready to mitigate the impact of a successful malware or ransomware attack. Key strategies here include regular data backups, airtight access management, and zero trust segmentation to stop the spread of an attack.

Data backups

Regular data backup is one of the most effective ways to mitigate the impact of an attack. Back up essential data using immutable Write Once Read Many (WORM) storage, which ensures that data cannot be altered or deleted, protecting it from ransomware encryption or manipulation. Implement the 3-2-1 backup strategy: create three copies of your data, using two different formats, and keep one copy off-site.

Access management

Strong access management is another effective way to minimize the risk and impact of malware or ransomware attacks. This includes enforcing the zero trust principle of least privilege, where users are granted only the access necessary to perform their job function, thereby significantly reducing the number of potential entry points and pathways that attackers could exploit.

Zero trust segmentation

Segmentation is crucial for mitigating the impact of malware or ransomware attacks. Unlike traditional network segmentation, microsegmentation or zero trust segmentation applies policies directly to applications or workloads, allowing for precise control over access to resources. Strict segmentation policies effectively reduce the ways attackers can move laterally through the network, significantly reducing the chances of malware and ransomware spreading.

Future trends in malware and ransomware

As the cybersecurity industry develops new defenses against malware and ransomware, cybercriminals are evolving their tactics. Understanding trends in this area can help you stay ahead of emerging threats.

Evolving threats

The ThreatLabz 2024 Ransomware Report highlights several key emerging threats, including:

• Highly targeted ransomware attacks: Groups like Dark Angels are focusing on a few multibillion-dollar companies, demanding substantial ransoms while avoiding law enforcement scrutiny—a tactic likely to be adopted by more threat actors in 2025.
• Voice-based social engineering: Targeted attacks are expected to increasingly employ vishing, with initial access brokers like Qakbot and Scattered Spider using it to trick individuals into granting access to corporate networks, leading to data theft and ransomware deployment.
• AI-enhanced malware: Cybercriminals will continue to leverage AI and ML to develop more advanced malware, including polymorphic malware that evades detection, and highly personalized phishing attacks.

Emerging solutions

To combat these fast-evolving threats, organizations must adopt solutions that leverage AI/ML for faster detection and defense. Zscaler ensures comprehensive security through zero trust and AI:

• AI-powered phishing and C2 detection identifies and blocks never-before-seen phishing sites and command-and-control infrastructure inline.
• AI-powered sandboxing analyzes suspicious files in a controlled environment to prevent malware and zero-day threats.
• AI-driven segmentation automates access policy recommendations to reduce the attack surface and prevent lateral movement by analyzing user and app behavior.
• AI-powered browser isolation renders web content as images to create a secure gap between users and malicious content, preventing data leaks and the delivery of active threats.
• AI-driven data discovery and classification provides instant visibility and classification across endpoint, inline, and cloud data, making it more difficult for ransomware to target and encrypt sensitive data.

Key takeaways to protect your organization 

Ransomware and malware are relentless adversaries for organizations everywhere. Staying ahead of these threats requires a multilayered defense strategy that doesn’t stop at prevention, but also includes advanced detection measures and a solid response plan.

Here are the key things to keep in mind:

• Know your enemy—understand the threat landscape: Stay up to speed on the different types of malware, emerging ransomware variants, and the attack vectors and tactics cybercriminals use.
• Implement robust prevention strategies: Educate employees, keep systems updated, enforce MFA, and most important, adopt a zero trust architecture as the foundation of your security posture.
• Be ready to act: Equip your organization with AI-driven tools for real-time threat detection and response, and have a clear incident response plan in place for when—not if—an attack happens.
• Mitigate the impact: Strategies such as regular backups, strong access management, and zero trust segmentation can mean the difference between a minor incident and a full-blown disaster.

Vigilance, strategic planning, and the right solutions will ensure your organization’s assets are protected and ready for whatever the unpredictable world of malware and ransomware has in store.

Learn more about how your organization can mitigate malware and ransomware attacks. Download the Zscaler ThreatLabz 2024 Ransomware Report for in-depth analysis of the latest ransomware trends and guidance on key security to prevent initial compromise, eliminate lateral movement, and stop data loss.