Summary

In this chapter, we took a closer look at some of the main attack vectors that ransomware operators are using to get their foot in the door, by either using existing credentials or phishing attacks to lure end users and gain access to a compromised machine.

In most cases, attackers utilize one or multiple vulnerabilities either directly on an end user’s machine or to exploit external services that the organization has available.

We also took a look at some of the extortion tactics attackers use, in addition to other attack vectors, such as DDoS attacks, to pressure organizations into paying the ransom.

Then, we looked closer at some of the more well-known ransomware operators and their modus operandi, as well as some of the more frequently used attack vectors regarding identity and exploiting vulnerabilities and how they have been used in successful attacks.

Finally, we looked into how to monitor vulnerabilities and some of the sources that can be useful assets in your toolbox.

In the next chapter, we will start to look at countermeasures and build a secure foundation for our IT services, as well as adopt a zero-trust-based security architecture.