Cyber

What changed

Recent reports indicate a troubling trend in ransomware attacks, where criminals are not only locking files and stealing data but are now also threatening employees and their families to compel organizations to pay ransoms. This shift in tactics highlights the evolving nature of cyber threats and the lengths to which attackers will go to achieve their objectives.

The Semperis 2026 Ransomware Risk Report reveals that 37% of successful ransomware attacks involved threats directed at the friends or relatives of employees, underscoring the need for enhanced security measures and employee awareness.

Who is affected

This alarming trend affects a wide range of organizations across various sectors, particularly those with valuable data or critical operations. The following groups are particularly vulnerable:

Companies with significant employee bases are at risk, especially in industries such as healthcare, finance, and technology.

• Healthcare providers managing sensitive patient data.
• Financial institutions handling large volumes of transactions.
• Technology firms with proprietary information and intellectual property.
• Government agencies that may be targeted for sensitive information.

What to do

Organizations must take proactive steps to mitigate the risks associated with these evolving ransomware tactics. This includes implementing robust security protocols and enhancing employee training to recognize and respond to threats.

Additionally, companies should consider developing comprehensive incident response plans that address the potential for threats against employees and their families.

• Conduct regular security training sessions for employees to raise awareness about ransomware threats.
• Implement multi-factor authentication and strong access controls to protect sensitive data.
• Establish a clear communication plan for employees in the event of a ransomware attack.
• Engage with cybersecurity experts to evaluate and strengthen your organization's defenses.

What changed

Ivanti Connect Secure has become the focal point of a new wave of cyberattacks, where attackers are employing a chained exploitation strategy. This approach not only compromises the system but also involves meticulous efforts to erase traces of their activities, complicating forensic investigations.

The implications of such tactics are significant, as they hinder the ability of security teams to respond effectively and understand the full scope of the breach.

Who is affected

Organizations utilizing Ivanti Connect Secure are at heightened risk due to these targeted attacks. The following groups should be particularly vigilant:

IT departments managing remote access solutions, security teams tasked with incident response, and any enterprise relying on Ivanti products for secure connectivity.

• Ivanti Connect Secure users
• Organizations with remote workforces
• IT security teams
• Enterprises leveraging Ivanti's security solutions

What to do

Organizations are urged to enhance their monitoring and incident response capabilities in light of these developments. Immediate steps should include reviewing access logs, updating security protocols, and ensuring that all systems are patched against known vulnerabilities.

Additionally, employing threat intelligence tools can help in identifying potential indicators of compromise and preemptively addressing vulnerabilities.

• Review and enhance monitoring of Ivanti Connect Secure systems
• Implement robust incident response protocols
• Conduct thorough access log analysis
• Stay updated on threat intelligence related to Ivanti products