Palo Alto Networks’ Unit 42 Study: Ransomware Hits Indian Manufacturing Sector Hardest

Palo Alto Networks’ Unit 42 recently published its Ransomware Retrospective 2024: Unit 42 Leak Site Analysis and Incident Response report. This report delved into 3,998 leak site posts from various ransomware groups, which are platforms where stolen data is publicly disclosed to coerce victims into paying ransom.

Key findings of the study reveal a 49% year-over-year increase in multi-extortion ransomware attacks globally from 2022 to 2023. Notably, in India, the manufacturing sector stood out as the primary target for ransomware extortion in 2023. Among the 3,998 leak site posts globally, LockBit ransomware was the most active, affecting 928 organizations, constituting 23% of the total. LockBit also remained highly active in APAC and India. Additionally, 25 new ransomware leak sites emerged in 2023, with Akira being the most prominent.

Anil Valluri, Managing Director and Vice President for India and SAARC at Palo Alto Networks emphasized the concerning trend of the manufacturing sector being vulnerable to ransomware attacks due to limited visibility into operational technology systems, inadequate network monitoring, and suboptimal cyber-hygiene practices. Valluri stressed the need for organizations to adopt a Zero Trust network architecture to enhance security layers.

Valluri further noted the cybersecurity challenges in India, with organizations grappling with a mix of modern and legacy systems, leaving significant security gaps. He advocated for integrated cybersecurity solutions to mitigate these challenges effectively.

The report highlighted a significant increase in ransomware leak site posts compared to the previous year, attributed to zero-day exploits targeting vulnerabilities in systems like MOVEit Transfer SQL Injection and GoAnywhere MFT.

Unit 42’s analysis of over 600 incidents from 250 organizations for the 2024 Incident Response Report revealed a decline in phishing as an initial access tactic, replaced by the exploitation of software and API vulnerabilities. Threat actors were found to indiscriminately gather data in 93% of incidents, indicating a shift towards broad data collection rather than targeting specific datasets.

Huzefa Motiwala, Director of Systems Engineering for India and SAARC acknowledged the alarming rise in ransomware incidents but noted positive shifts in organizations’ response strategies. Despite increased ransom demands, median payouts decreased, suggesting organizations’ readiness to engage Incident Response teams, deterring threat actors.