Sophos: Ransomware, attacker behaviour to shape IT security in 2021


British cybersecurity firm Sophos released its latest threat report for the year 2021 on Monday, November 23.

“As much of the world shifted to remote work in 2020, cybercriminals upped their game, devising ways to use the fears and anxieties of organizations and end-users against them,” the cybersecurity firm stated. 

“Ransomware continues to be a daily threat, made worse by IT admins scrambling to meet work-from-home security requirements. IT professionals once again needed to shift their focus and adjust their game plans to meet new, rising threats,” it added.


The gap between ransomware operators at different ends of the skills and resource spectrum will increase, according to the “Sophos 2021 Threat Report”.

At the high end, the big-game hunting ransomware families will continue to refine and change their tactics, techniques and procedures (TTPs) to become more evasive and nation-state-like in sophistication, targeting larger organizations with multimillion-dollar ransom demands.

In 2020, such families included Ryuk and RagnarLocker.

Meanwhile, Sophos is also anticipating an increase in the number of entry-level, apprentice-type attackers looking for menu-driven, ransomware-for-rent, such as Dharma, that allows them to target high volumes of smaller prey.

Another ransomware trend is “secondary extortion”, where alongside the data encryption the attackers steal and threaten to publish sensitive or confidential information if their demands are not met.

In 2020, Sophos reported on Maze, RagnarLocker, Netwalker, REvil, and others using this approach.

“The ransomware business model is dynamic and complex. During 2020, Sophos saw a clear trend towards adversaries differentiating themselves in terms of their skills and targets,” Chester Wisniewski, Principal Research Scientist, Sophos, said in a statement.

“However, we’ve also seen ransomware families sharing best-of-breed tools and forming self-styled collaborative ‘cartels’,” said Chester Wisniewski, principal research scientist, Sophos.

The company also anticipates that next year, everyday threats such as commodity malware, including loaders and botnets, or human-operated Initial Access Brokers, will demand serious security attention.

Furthermore, all ranks of adversaries will increasingly abuse legitimate tools, well-known utilities and common network destinations to evade detection and security measures and thwart analysis and attribution, said the report.

Additional trends analyzed in the Sophos 2021 Threat Report include:

  • Attacks on servers: adversaries have targeted server platforms running both Windows and Linux, and leveraged these platforms to attack organizations from within
  • The impact of the COVID 19 pandemic on IT security, such as the security challenges of working from home using personal networks protected by widely varying levels of security
  • The security challenges facing cloud environments: cloud computing has successfully borne the brunt of a lot of the enterprise needs for secure computing environments, but faces challenge different from those of a traditional enterprise network
  • Common services like RDP and VPN concentrators, which remain a focus for attacks on the network perimeter. Attackers also use RDP to move laterally within the breached network.
  • Software applications traditionally flagged as “potentially unwanted” because they delivered a plethora of advertisements, but engaged in tactics that are increasingly indistinguishable from overt malware
  • The surprising reappearance of an old bug, VelvetSweatshop – a default password feature for earlier versions of Microsoft Excel – used to conceal macros or other malicious content in documents and evade advanced threat detection
  • The need to apply approaches from epidemiology to quantify unseen, undetected, and unknown cyber threats in order to better bridge gaps in detection, assess risk and define priorities

— (Source: Business Standard)

You Might Also Want To Read: Humans to Devices: Cybersecurity firm warns of ‘nCoV’ computer virus