Evolving Cyber Threats: Beyond Ransomware

A tested backup can help an organization recover encrypted files. It cannot retrieve confidential records already copied by an attacker, or explain whether a trusted software update introduced malicious code. Ransomware planning is necessary, but it covers only part of the problem.

The useful question is how an attacker can gain access, use that access, and create consequences for the people who depend on the system. This article examines several paths that deserve attention alongside encryption.

Understand what recovery can and cannot solve

Network segmentation, endpoint protection, and rehearsed recovery procedures can limit the damage from an intrusion. Attackers can still seek payment by threatening to disclose stolen data. CISA’s September 2023 StopRansomware Guide addresses data extortion as well as ransomware.

That distinction changes the investigation. Restoring operations and determining what information was accessed are separate tasks. Organizations need evidence for both.

Law enforcement disruption and changes in commercial incentives can affect criminal operations, but they do not establish that ransomware is disappearing. Likewise, insurance arrangements vary. A security plan should be based on the organization’s exposure and recovery needs, with coverage questions reviewed against its actual policy.

Examine trusted supply chains

Software providers, managed service providers, and development dependencies can give an attacker a route into multiple organizations. The mechanism is trust: a customer permits a supplier to deliver code, administer systems, or access information.

Review where that trust is granted. Build systems need protected credentials and controlled release processes. Third-party administrative access should be limited and logged. Dependency inventories help identify which applications contain an affected component.

Code signing is useful for establishing the source and integrity of an artifact. A valid signature does not prove that the artifact is safe if the supplier’s build process was compromised. Combine provenance checks with controls over what the software can do after installation.

Investigate data theft on its own terms

An extortion attempt may focus on a particular dataset rather than widespread encryption. An attacker might copy customer records, internal documents, or intellectual property while leaving services available.

Define where sensitive information is stored and how it can leave the environment. Look for unusual access volume, unexpected archive creation, and transfers that do not fit the account’s role. Each is an investigative lead; legitimate work may produce similar activity.

The response needs to establish which records were exposed, what evidence supports that conclusion, and what remains unknown. Availability alone is an incomplete measure of impact.

Review APIs and management systems

APIs connect applications, but each request still needs appropriate authentication and authorization. A user who can change an object identifier and retrieve someone else’s record has crossed an access boundary even if the login itself was valid.

Inventory deprecated endpoints and test permissions at the object and function levels. Review business logic as well as rate limiting. A slow unauthorized request is still unauthorized.

Management systems deserve similar attention. Virtualization consoles, cloud administration, and operational technology interfaces can affect many dependent services. Establish who can reach them and how administrative activity is recorded. In an industrial environment, containment decisions must account for physical operations and the people responsible for them.

Detect misuse of legitimate tools

An attacker may use PowerShell, Windows Management Instrumentation, or an approved remote administration tool. The presence of the tool alone tells the defender little.

Context makes the behavior useful: who launched it, on which host, with what arguments, and what happened next. Compare the activity with the account’s normal responsibilities and correlate it with authentication and network records.

Criminal specialization adds another complication. The person who first obtains access may sell it to someone else. A change in behavior can matter even when the entry point remains the same.

AI-assisted phishing and code generation are also worth evaluating, but capability demonstrations should not be treated as evidence of widespread operational use. Prioritize the attack paths visible in your environment.

Build a defensible response

Use least privilege and segmentation to restrict what a compromised identity or system can reach. Assign owners to supplier access and application permissions. Test detections against specific behaviors, and document the telemetry they require.

Recovery plans should include trusted rebuilds, credential and session handling, and correction of the initial weakness. A rebuilt system remains exposed if the attacker still controls its administrator account.

Start by walking through one service from supplier to application to data store. Identify where trust is granted and what evidence would show its misuse. That gives the security team a concrete basis for improving prevention, investigation, and recovery.